Skip to content

OCPBUGS-65621: add dedicated service account to crb, cvo and version pod #1266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ehearne-redhat wants to merge 21 commits into
base: main
Choose a base branch
from
Open

OCPBUGS-65621: add dedicated service account to crb, cvo and version pod #1266

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
bf44d47
add dedicated service account to crb, cvo and version pod
ehearne-redhat Nov 28, 2025
29bce17
add new line to keep linter happy
ehearne-redhat Nov 28, 2025
2982ece
add sa to testrendermanifest
ehearne-redhat Nov 28, 2025
ca25977
add dedicated sa for update payload
ehearne-redhat Nov 28, 2025
825ac61
add cluster-admin clusterrole
ehearne-redhat Nov 29, 2025
446f19b
remove cluster-admin role from file
ehearne-redhat Nov 30, 2025
bb1602f
add new cluster role with watch feature gate
ehearne-redhat Dec 1, 2025
d7e4cd0
re-add cluster-admin
ehearne-redhat Dec 1, 2025
5641681
rename roles to ensure service account is added first
ehearne-redhat Dec 3, 2025
5fe9198
rename cvo-dedicated-sa to cluster-version-operator
ehearne-redhat Dec 3, 2025
6310c45
add default sa crb back to test into and out of change test failures
ehearne-redhat Dec 4, 2025
b39df2b
add back featuregate read role + remove default crb
ehearne-redhat Dec 4, 2025
7d69c50
add new reader permissions
ehearne-redhat Dec 5, 2025
0c875cc
add leases role and role binding
ehearne-redhat Dec 5, 2025
7b05705
move roles back to 02 but ZZ to ensure applied last step of 02
ehearne-redhat Dec 11, 2025
31c2b46
add annotations to ensure inclusion
ehearne-redhat Dec 12, 2025
9002190
add scc privilege to cluster-version-operator service account
ehearne-redhat Dec 12, 2025
38530cd
add missing annotations
ehearne-redhat Dec 15, 2025
a575e1c
allow cluster-version-operator service account to use hostaccess scc
ehearne-redhat Dec 16, 2025
fc55fa5
simplify role bindings to resolve scc test failure
ehearne-redhat Dec 17, 2025
7be8122
ensure different names for crbs
ehearne-redhat Jan 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 44 additions & 0 deletions install/0000_00_cluster-version-operator_02_ZZ_roles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: cluster-version-operator-1
annotations:
include.release.openshift.io/self-managed-high-availability: "true"
subjects:
- kind: ServiceAccount
name: cluster-version-operator
namespace: openshift-cluster-version
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: cluster-version-operator-payload
annotations:
include.release.openshift.io/self-managed-high-availability: "true"
subjects:
- kind: ServiceAccount
name: update-payload-dedicated-sa
namespace: openshift-cluster-version
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: cluster-version-operator
annotations:
kubernetes.io/description: Grant the cluster-version operator permission to perform cluster-admin actions while managing the OpenShift core.
include.release.openshift.io/self-managed-high-availability: "true"
roleRef:
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
namespace: openshift-cluster-version
name: default
14 changes: 0 additions & 14 deletions install/0000_00_cluster-version-operator_02_roles.yaml
View file
Open in desktop

This file was deleted.

17 changes: 17 additions & 0 deletions install/0000_00_cluster-version-operator_02_service_account.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: cluster-version-operator
namespace: openshift-cluster-version
annotations:
kubernetes.io/description: Dedicated Service Account for the Cluster Version Operator.
include.release.openshift.io/self-managed-high-availability: "true"
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: update-payload-dedicated-sa
namespace: openshift-cluster-version
annotations:
kubernetes.io/description: Dedicated Service Account for the Update Payload.
include.release.openshift.io/self-managed-high-availability: "true"
1 change: 1 addition & 0 deletions install/0000_00_cluster-version-operator_03_deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ spec:
k8s-app: cluster-version-operator
spec:
automountServiceAccountToken: false
serviceAccountName: cluster-version-operator
containers:
- name: cluster-version-operator
image: '{{.ReleaseImage}}'
Expand Down
1 change: 1 addition & 0 deletions pkg/cvo/updatepayload.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,6 +232,7 @@ func (r *payloadRetriever) fetchUpdatePayloadToDir(ctx context.Context, dir stri
},
},
Spec: corev1.PodSpec{
ServiceAccountName: "update-payload-dedicated-sa",
ActiveDeadlineSeconds: deadline,
InitContainers: []corev1.Container{
setContainerDefaults(corev1.Container{
Expand Down
1 change: 1 addition & 0 deletions pkg/payload/testdata/TestRenderManifest_expected_cvo_deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ spec:
k8s-app: cluster-version-operator
spec:
automountServiceAccountToken: false
serviceAccountName: cluster-version-operator
containers:
- name: cluster-version-operator
image: 'quay.io/cvo/release:latest'
Expand Down