Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Multiple role bindings end up added to a bootstrap namespace node policy? #16611

Closed
smarterclayton opened this issue Sep 29, 2017 · 6 comments
Closed

Multiple role bindings end up added to a bootstrap namespace node policy? #16611

smarterclayton opened this issue Sep 29, 2017 · 6 comments
Assignees
@enj
Labels
area/security priority/P1 sig/security
Milestone
v3.7

Comments

@smarterclayton
Copy link
Contributor

From my PR, adding a new namespace role:

$ oc get rolebindings -n openshift-node
NAME                        ROLE                         USERS     GROUPS                                                   SERVICE ACCOUNTS   SUBJECTS
system:node-config-reader   /system:node-config-reader             system:nodes, system:nodes, system:nodes, system:nodes

restart apiserver

$ oc get rolebindings -n openshift-node
NAME                        ROLE                         USERS     GROUPS                                                                 SERVICE ACCOUNTS   SUBJECTS
system:node-config-reader   /system:node-config-reader             system:nodes, system:nodes, system:nodes, system:nodes, system:nodes

Looks like its happening for others:

openshift         shared-resource-viewers                          openshift/shared-resource-viewer                                       system:authenticated, system:authenticated, system:authenticated, system:authenticated, system:authenticated
@smarterclayton
Copy link
Contributor Author

@enj related to your changes?

@smarterclayton smarterclayton mentioned this issue Sep 29, 2017
Merged
@enj enj mentioned this issue Sep 29, 2017
Merged
@enj
Copy link
Contributor

enj commented Sep 29, 2017

@smarterclayton kubernetes/kubernetes#53239

@enj enj self-assigned this Sep 29, 2017
@enj enj added this to the 3.7.0 milestone Sep 29, 2017
@enj enj mentioned this issue Sep 30, 2017
Closed
@enj
Copy link
Contributor

enj commented Sep 30, 2017

Added to 3.7 pick list #16361 so this should be closed once that is done.

@enj
Copy link
Contributor

enj commented Oct 1, 2017

@liggitt was closing this intentional?

@liggitt liggitt reopened this Oct 1, 2017
@liggitt
Copy link
Contributor

liggitt commented Oct 1, 2017 •
edited
Loading

no, that was github being clever... I'd recommend not putting fixes <origin issue> in kube PR descriptions in the future

@simo5
Copy link
Contributor

simo5 commented Oct 16, 2017

Merged as part of pick list

@simo5 simo5 closed this as completed Oct 16, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@enj enj

Labels
area/security priority/P1 sig/security
Projects
None yet
Milestone
v3.7
Development

No branches or pull requests
4 participants
@liggitt @smarterclayton @enj @simo5