search

xtf-cz / xtf

MIT License
12 stars 55 forks source link

Is BuildManager wrongly creating a system:image-puller RoleBinding? #536

Closed fabiobrz closed 1 year ago

fabiobrz commented 1 year ago

When being instantiated, BuildManager wants for the authenticated users group to be able and access images it stores, see describe rolebinding.rbac

This is described by the docs, see https://docs.openshift.com/container-platform/4.12/openshift_images/managing_images/using-image-pull-secrets.html#images-allow-pods-to-reference-images-across-projects_using-image-pull-secrets but in some cases it clashes with downstream business logic, e.g.: when calling OpenShiftWaiters.isProjectClean(), a list of removable resources is collected and the an unexpected role binding - named system:image-puller is found, holding the connection between the system:image-puller role itself and the authenticated users group.

This makes tests that assert isProjectClean() fail unexpectedly.

Note: it has been suggested that the issue wouldn't be hit in case the xtf.openshift.namespace and the xtf.bm.namespace properties are set to two different values. In such a case the case when those are not should be handled.