missing permission to update scc on openshift

[gatekeeper]

missing permission to update scc on openshift

[font]

This may be resolved by #46.

@willkutler The operator itself will need permissions to grant the necessary permissions to Gatekeeper (prevents privilege escalation). I would suggest we look at either fixing #46, or providing a kustomize overlay for this OpenShift specific RBAC permission.

[JAORMX]

We should not update the default SCCs in OpenShift. They even if we give permissions to the operator to update these permissions, OpenShift will eventually overwrite them back to how they're supposed to be. If we need an SCC with permissions that are not applicable by the default ones, the good practice is to create our own SCC.

Also, in RBAC, to use an SCC we need to use the verb use.

[ycao56]

I am not hitting smiliar permission issue after using latest bundle-index image built by this repo.
This time it was about psp. This is because psp was added in 3.2.1.

2020-12-07T19:33:25.807Z	ERROR	controller	Reconciler error	{"reconcilerGroup": "operator.gatekeeper.sh", "reconcilerKind": "Gatekeeper", "controller": "gatekeeper", "name": "gatekeeper", "namespace": "gatekeeper-system", "error": "Unable to deploy Gatekeeper resources: Error attempting to create resource /gatekeeper-admin: podsecuritypolicies.policy is forbidden: User \"system:serviceaccount:gatekeeper-system:default\" cannot create resource \"podsecuritypolicies\" in API group \"policy\" at the cluster scope", "errorVerbose": "podsecuritypolicies.policy is forbidden: User \"system:serviceaccount:gatekeeper-system:default\" cannot create resource \"podsecuritypolicies\" in API group \"policy\" at the cluster scope\nError attempting to create resource /gatekeeper-admin\ngithub.com/gatekeeper/gatekeeper-operator/controllers.(*GatekeeperReconciler).updateOrCreateResource\n\t/workspace/controllers/gatekeeper_controller.go:280\ngithub.com/gatekeeper/gatekeeper-operator/controllers.(*GatekeeperReconciler).deploy...
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:218
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).worker
	/workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:197
k8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1
	/workspace/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:155
k8s.io/apimachinery/pkg/util/wait.BackoffUntil
	/workspace/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:156
k8s.io/apimachinery/pkg/util/wait.JitterUntil
	/workspace/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:133
k8s.io/apimachinery/pkg/util/wait.Until
	/workspace/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:90

[font]

I am not hitting smiliar permission issue after using latest bundle-index image built by this repo.
This time it was about psp. This is because psp was added in 3.2.1.

2020-12-07T19:33:25.807Z	ERROR	controller	Reconciler error	{"reconcilerGroup": "operator.gatekeeper.sh", "reconcilerKind": "Gatekeeper", "controller": "gatekeeper", "name": "gatekeeper", "namespace": "gatekeeper-system", "error": "Unable to deploy Gatekeeper resources: Error attempting to create resource /gatekeeper-admin: podsecuritypolicies.policy is forbidden: User \"system:serviceaccount:gatekeeper-system:default\" cannot create resource \"podsecuritypolicies\" in API group \"policy\" at the cluster scope", "errorVerbose": "podsecuritypolicies.policy is forbidden: User \"system:serviceaccount:gatekeeper-system:default\" cannot create resource \"podsecuritypolicies\" in API group \"policy\" at the cluster scope\nError attempting to create resource /gatekeeper-admin\ngithub.com/gatekeeper/gatekeeper-operator/controllers.(*GatekeeperReconciler).updateOrCreateResource\n\t/workspace/controllers/gatekeeper_controller.go:280\ngithub.com/gatekeeper/gatekeeper-operator/controllers.(*GatekeeperReconciler).deploy...
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:218
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).worker
	/workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:197
k8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1
	/workspace/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:155
k8s.io/apimachinery/pkg/util/wait.BackoffUntil
	/workspace/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:156
k8s.io/apimachinery/pkg/util/wait.JitterUntil
	/workspace/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:133
k8s.io/apimachinery/pkg/util/wait.Until
	/workspace/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:90

@ycao56 This was caused by the bundle being out-of-date from the config manifests. I've created #75 to update the bundle and #76 to verify we don't miss it again in the future.

[font]

@ycao56 This should be fixed now so I am closing. Please re-open if that's not the case.