Bug 1977924: [release-4.8] Ensure scc compatibility with BoundServiceAccountTokenVolume by stlaz · Pull Request #842 · openshift/kubernetes

stlaz · 2021-07-01T15:00:25Z

Previous to the BoundServiceAccountTokenVolume feature being enabled, the automatic mounting of legacy token secrets required that an scc permit secret volume sources either implicitly (by allowing all volume sources) or explicitly (by specifying 'secret' in the set of allowed volumes).

To ensure compatibility with this permission scheme for the projected token volumes enabled by BoundServiceAccountTokenVolume, this commit ensures that the projected volumes of service account tokens will be permitted under the same criteria (i.e. secret volume sources are allowed by an scc).

/cc @sttts @s-urbaniak @marun

… publishing This commit should be squashed with: UPSTREAM: <carry>: Ensure service ca is mounted for projected tokens

openshift-ci · 2021-07-01T15:00:31Z

@stlaz: This pull request references Bugzilla bug 1977920, which is invalid:

expected the bug to target the "4.8.0" release, but it targets "4.9.0" instead
expected Bugzilla bug 1977920 to depend on a bug targeting a release in 4.9.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

Bug 1977920: Ensure scc compatibility with BoundServiceAccountTokenVolume

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2021-07-01T15:00:33Z

@stlaz: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

77f51a6|UPSTREAM: : bump(apiserver-library-go): does not specify an upstream backport in the commit message
e379666|UPSTREAM: : Add unit testing for service ca configmap publishing: does not specify an upstream backport in the commit message

sttts · 2021-07-01T15:01:11Z

/lgtm
/approve

openshift-ci · 2021-07-01T15:01:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: stlaz, sttts

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~DOWNSTREAM_OWNERS~~ [sttts]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2021-07-01T15:02:01Z

@stlaz: This pull request references Bugzilla bug 1977924, which is invalid:

expected the bug to be in one of the following states: NEW, ASSIGNED, ON_DEV, POST, POST, but it is ON_QA instead
expected dependent Bugzilla bug 1977920 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is POST instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

[4.8] Bug 1977924: Ensure scc compatibility with BoundServiceAccountTokenVolume

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sttts · 2021-07-01T15:03:04Z

/bugzilla refresh

openshift-ci · 2021-07-01T15:03:18Z

@sttts: This pull request references Bugzilla bug 1977924, which is invalid:

expected the bug to be in one of the following states: NEW, ASSIGNED, ON_DEV, POST, POST, but it is ON_QA instead
expected dependent Bugzilla bug 1977920 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is POST instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

bparees · 2021-07-01T15:10:38Z

/bugzilla refresh

openshift-ci · 2021-07-01T15:10:43Z

@bparees: This pull request references Bugzilla bug 1977924, which is invalid:

expected the bug to be in one of the following states: NEW, ASSIGNED, ON_DEV, POST, POST, but it is MODIFIED instead
expected dependent Bugzilla bug 1977920 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is POST instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

bparees · 2021-07-01T15:11:16Z

/bugzilla refresh

openshift-ci · 2021-07-01T15:12:23Z

@bparees: This pull request references Bugzilla bug 1977924, which is invalid:

expected dependent Bugzilla bug 1977920 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is POST instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

vikaslaad · 2021-07-01T16:05:21Z

/retest

vikaslaad · 2021-07-01T17:37:12Z

/retest

openshift-bot · 2021-07-01T18:35:49Z

/retest

Please review the full test history for this PR and help us cut down flakes.

sttts · 2021-07-01T20:06:51Z

/retest

unrelated

vikaslaad · 2021-07-01T21:14:17Z

/retest

openshift-bot · 2021-07-01T21:16:57Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-01T23:26:57Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-02T01:29:56Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-02T01:41:57Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-02T02:53:57Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-02T03:05:57Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-02T03:29:57Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-02T03:41:57Z

/retest

Please review the full test history for this PR and help us cut down flakes.

marun · 2021-07-02T03:56:29Z

/retitle Bug 1977924: [release-4.8] Ensure scc compatibility with BoundServiceAccountTokenVolume

marun · 2021-07-02T04:18:24Z

Test failure in e2e-gcp can be overridden. Test should be skipped (addressed by openshift/origin#26267).

Disruptive failure can also be overridden, should be optional (addressed by openshift/release#19909).

openshift-bot · 2021-07-02T05:41:57Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-02T07:41:57Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-02T07:53:57Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-02T08:54:11Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-02T09:06:11Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-02T09:42:12Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-07-02T09:54:11Z

/retest

Please review the full test history for this PR and help us cut down flakes.

mfojtik · 2021-07-02T11:04:48Z

/override ci/prow/e2e-aws-disruptive
/override ci/prow/e2e-gcp

openshift-ci · 2021-07-02T11:05:14Z

@mfojtik: Overrode contexts on behalf of mfojtik: ci/prow/e2e-aws-disruptive, ci/prow/e2e-gcp

Details

In response to this:

/override ci/prow/e2e-aws-disruptive
/override ci/prow/e2e-gcp

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2021-07-02T11:05:23Z

@stlaz: All pull requests linked via external trackers have merged:

Bugzilla bug 1977924 has been moved to the MODIFIED state.

Details

In response to this:

Bug 1977924: [release-4.8] Ensure scc compatibility with BoundServiceAccountTokenVolume

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

marun and others added 2 commits July 1, 2021 16:55

UPSTREAM: <carry>: <squash> Add unit testing for service ca configmap…

e379666

… publishing This commit should be squashed with: UPSTREAM: <carry>: Ensure service ca is mounted for projected tokens

UPSTREAM: <drop>: bump(apiserver-library-go)

77f51a6

openshift-ci bot requested review from marun, s-urbaniak and sttts July 1, 2021 15:00

openshift-ci-robot added the backports/unvalidated-commits Indicates that not all commits come to merged upstream PRs. label Jul 1, 2021

openshift-ci bot added the bugzilla/severity-urgent Referenced Bugzilla bug's severity is urgent for the branch this PR is targeting. label Jul 1, 2021

openshift-ci bot added the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label Jul 1, 2021

openshift-ci bot added the vendor-update Touching vendor dir or related files label Jul 1, 2021

sttts removed the backports/unvalidated-commits Indicates that not all commits come to merged upstream PRs. label Jul 1, 2021

openshift-ci bot assigned sttts Jul 1, 2021

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jul 1, 2021

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 1, 2021

stlaz changed the title ~~Bug 1977920: Ensure scc compatibility with BoundServiceAccountTokenVolume~~ [4.8] Bug 1977924: Ensure scc compatibility with BoundServiceAccountTokenVolume Jul 1, 2021

sttts changed the title ~~[4.8] Bug 1977924: Ensure scc compatibility with BoundServiceAccountTokenVolume~~ Bug 1977924: Ensure scc compatibility with BoundServiceAccountTokenVolume Jul 1, 2021

mfojtik added the staff-eng-approved Indicates a release branch PR has been approved by a staff engineer (formerly group/pillar lead). label Jul 1, 2021

bparees added bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. and removed bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. labels Jul 1, 2021

openshift-ci bot changed the title ~~Bug 1977924: Ensure scc compatibility with BoundServiceAccountTokenVolume~~ Bug 1977924: [release-4.8] Ensure scc compatibility with BoundServiceAccountTokenVolume Jul 2, 2021

mfojtik merged commit 66b664d into openshift:release-4.8 Jul 2, 2021

Comments

Conversation

stlaz commented Jul 1, 2021

Uh oh!

openshift-ci bot commented Jul 1, 2021

Uh oh!

openshift-ci-robot commented Jul 1, 2021

Uh oh!

sttts commented Jul 1, 2021

Uh oh!

openshift-ci bot commented Jul 1, 2021

Uh oh!

openshift-ci bot commented Jul 1, 2021

Uh oh!

sttts commented Jul 1, 2021

Uh oh!

openshift-ci bot commented Jul 1, 2021

Uh oh!

bparees commented Jul 1, 2021

Uh oh!

openshift-ci bot commented Jul 1, 2021

Uh oh!

bparees commented Jul 1, 2021

Uh oh!

openshift-ci bot commented Jul 1, 2021

Uh oh!

vikaslaad commented Jul 1, 2021

Uh oh!

vikaslaad commented Jul 1, 2021

Uh oh!

openshift-bot commented Jul 1, 2021

Uh oh!

sttts commented Jul 1, 2021

Uh oh!

vikaslaad commented Jul 1, 2021

Uh oh!

openshift-bot commented Jul 1, 2021

Uh oh!

openshift-bot commented Jul 1, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

marun commented Jul 2, 2021

Uh oh!

marun commented Jul 2, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

openshift-bot commented Jul 2, 2021

Uh oh!

mfojtik commented Jul 2, 2021

Uh oh!

openshift-ci bot commented Jul 2, 2021

Uh oh!

openshift-ci bot commented Jul 2, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects