NO-JIRA: scc: give all authenticated users access to restricted-v3 #1935

haircommander · 2025-10-08T13:22:51Z

No description provided.

coderabbitai · 2025-10-08T13:23:24Z

Walkthrough

Adds a new Kubernetes RBAC manifest that creates a ClusterRoleBinding named system:openshift:scc:restricted-v3 binding ClusterRole system:openshift:scc:restricted-v3 to the Group system:authenticated, with three metadata annotations.

Changes

Cohort / File(s)	Summary of modifications
RBAC manifest addition `bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_crb-systemauthenticated-scc-restricted-v3.yaml`	Added a `ClusterRoleBinding` (apiVersion `rbac.authorization.k8s.io/v1`) binding ClusterRole `system:openshift:scc:restricted-v3` to Group `system:authenticated`; added three metadata annotations (release/HA/single-node developer statuses).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Pre-merge checks and finishing touches

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description Check	❓ Inconclusive	No description was provided in the pull request, leaving the reader without any context about the change which makes it impossible to assess relevance or details of the update.	Please add a brief description summarizing the change and its intent so reviewers can quickly understand the purpose of this update.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.
Title Check	✅ Passed	The title clearly summarizes the main change by stating that the SCC restricted-v3 will be granted to all authenticated users, which matches the changeset adding a ClusterRoleBinding for system:authenticated. It is concise, specific, and directly related to the diff.

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between d0c3849 and 48978cc.

📒 Files selected for processing (1)

bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_crb-systemauthenticated-scc-restricted-v3.yaml (1 hunks)

🔇 Additional comments (1)

bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_crb-systemauthenticated-scc-restricted-v3.yaml (1)

8-12: ClusterRole existence and unique binding verified – system:openshift:scc:restricted-v3 is defined and only referenced by a single ClusterRoleBinding; no duplicates found.

coderabbitai · 2025-10-08T13:27:32Z

...-manifests/0000_20_kube-apiserver-operator_00_crb-systemauthenticated-scc-restricted-v3.yaml

+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: Group
+  name: system:authenticated


⚠️ Potential issue | 🟠 Major

PR objective mismatch: unauthenticated group not granted.

Title/objective says to grant restricted-v3 to unauthenticated users, but the binding only targets system:authenticated. Add system:unauthenticated (or switch to it) to meet the objective. Safer: include both to avoid regressions.

Apply one of the following diffs.

Option A (add unauthenticated, keep authenticated):

subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:authenticated +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:unauthenticated

Option B (if intent is only unauthenticated):

subjects: - apiGroup: rbac.authorization.k8s.io kind: Group - name: system:authenticated + name: system:unauthenticated

Optional: If you choose Option A, consider renaming the file to drop “systemauthenticated” from the filename for clarity.

good catch robot. I am confused how restricted-v2 gets access to system:unauthenticated (I adapted this from the restricted-v2 one)

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Find all restricted-v2 ClusterRoleBinding manifests echo "=== Finding restricted-v2 ClusterRoleBinding files ===" fd -e yaml -e yml . bindata/bootkube/scc-manifests/ | xargs grep -l "restricted-v2" | head -20 echo -e "\n=== Examining restricted-v2 ClusterRoleBinding content ===" fd -e yaml -e yml . bindata/bootkube/scc-manifests/ --exec grep -l "restricted-v2" | xargs cat echo -e "\n=== Searching for any unauthenticated bindings to restricted SCCs ===" rg -n "system:unauthenticated" bindata/bootkube/scc-manifests/

Length of output: 4967

🏁 Script executed:

#!/bin/bash # Search entire repo for unauthenticated SCC bindings or related configuration echo "=== Searching entire repo for system:unauthenticated references ===" rg -n "system:unauthenticated" --type yaml echo -e "\n=== Searching for restricted SCC with unauthenticated ===" rg -n -B5 -A5 "restricted.*unauthenticated|unauthenticated.*restricted" echo -e "\n=== Looking at PR description and related files ===" # Check if there's a PR description file or related documentation fd -e md README echo -e "\n=== Checking for any default SCC assignments or documentation ===" rg -n "default.*scc|scc.*default" --type md echo -e "\n=== Looking for issue or enhancement references ===" rg -n "OCPBUGS|JIRA|https://issues" bindata/bootkube/scc-manifests/

Length of output: 5193

🏁 Script executed:

#!/bin/bash # Get PR description and details gh pr view 1935 --json title,body,author,number

Length of output: 189

@haircommander You correctly adapted from restricted-v2! I found that the restricted-v2 ClusterRoleBinding also only grants access to system:authenticated:

# bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_crb-systemauthenticated-scc-restricted-v2.yaml subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:authenticated

So restricted-v2 does not grant unauthenticated users access either, based on the manifests in this repository.

Since your PR title says "give unauthenticated users access to restricted-v3", there's a mismatch:

PR objective: Grant access to unauthenticated users

Current implementation: Grants access to authenticated users only

To fix this, you'll need to decide:

If the title is correct and you want unauthenticated users to have access, apply the bot's suggested Option A to add system:unauthenticated as an additional subject.

If the title is incorrect and you only want authenticated users (matching restricted-v2), update the PR title to say "authenticated" instead of "unauthenticated".

Which approach matches your actual requirements?

haircommander · 2025-10-08T16:28:30Z

/hold

I'm trying to figure out how unauthenticated users get access to restricted-v2

tchap · 2025-10-09T08:59:04Z

I'm trying to figure out how unauthenticated users get access to restricted-v2

From what I understand, it's available to all authenticated users? At least that's mentioned in the docs.

Signed-off-by: Peter Hunt <[email protected]>

haircommander · 2025-10-09T13:11:39Z

🤦 right that's what we want

/unhold

this is ready, sorry for the noise

tchap · 2025-10-13T11:31:34Z

/retest-required

tchap · 2025-10-14T08:04:36Z

/retest-required

tchap · 2025-10-14T13:48:02Z

/retest-required

tchap · 2025-10-15T08:37:04Z

There is a broken test now:

: [sig-auth][Feature:OpenShiftAuthorization] The default cluster RBAC policy should have correct RBAC rules [Suite:openshift/conformance/parallel] expand_less	2s
{  fail [github.com/openshift/origin/test/extended/authorization/rbac/groups_default_rules.go:286]: system:authenticated has extra permissions in namespace "":
{APIGroups:["security.openshift.io"], Resources:["securitycontextconstraints"], ResourceNames:["restricted-v3"], Verbs:["use"]}}

p0lyn0mial · 2025-10-15T08:50:14Z

/lgtm

p0lyn0mial · 2025-10-15T08:52:01Z

/lgtm cancel

we need to fix the failing tests - #1935 (comment)

openshift-ci · 2025-10-15T09:42:14Z

@tchap: This PR was included in a payload test run from openshift/origin#30384
trigger 0 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

openshift-ci · 2025-10-16T06:57:19Z

@tchap: This PR was included in a payload test run from openshift/origin#30384
trigger 0 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

openshift-ci · 2025-10-16T11:47:16Z

@tchap: This PR was included in a payload test run from openshift/origin#30384
trigger 1 job(s) of type informing for the ci release of OCP 4.21

periodic-ci-openshift-release-master-ci-4.21-upgrade-from-stable-4.20-e2e-aws-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/d6b1e380-aa85-11f0-95a7-712e44658b77-0

tchap · 2025-10-16T11:49:09Z

/retitle NO-JIRA: scc: give all authenticated users access to restricted-v3

openshift-ci-robot · 2025-10-16T11:49:16Z

@haircommander: This pull request explicitly references no jira issue.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

tchap · 2025-10-16T15:02:57Z

/payload-with-prs 4.21 ci informing openshift/origin#30384

openshift-ci · 2025-10-16T15:03:02Z

@tchap: trigger 1 job(s) of type informing for the ci release of OCP 4.21

periodic-ci-openshift-release-master-ci-4.21-upgrade-from-stable-4.20-e2e-aws-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/33e53000-aaa1-11f0-86f9-7907cfa77396-0

tchap · 2025-10-16T15:03:27Z

/retest

tchap · 2025-10-17T08:33:09Z

/retest

benluddy · 2025-10-24T17:31:15Z

/retest
/lgtm

I'm assuming openshift/origin#30384 will allow this test to pass for the presubmit now. Do you have a follow-up PR to origin ready?

benluddy · 2025-10-24T17:33:48Z

/lgtm cancel
/close

Moved to #1944.

openshift-ci · 2025-10-24T17:34:21Z

@benluddy: Closed this PR.

In response to this:

/lgtm cancel
/close

Moved to #1944.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2025-10-24T17:34:35Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: haircommander
Once this PR has been reviewed and has the lgtm label, please ask for approval from benluddy. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci bot requested review from dinhxuanvu and vrutkovs October 8, 2025 13:23

coderabbitai bot reviewed Oct 8, 2025

View reviewed changes

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 8, 2025

scc: give all authenticated users access to restricted-v3

721c337

Signed-off-by: Peter Hunt <[email protected]>

haircommander force-pushed the restricted-v3-unauthenticated branch from 48978cc to 721c337 Compare October 9, 2025 13:11

haircommander changed the title ~~scc: give unauthenticated users access to restricted-v3~~ scc: give all authenticated users access to restricted-v3 Oct 9, 2025

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 9, 2025

tchap mentioned this pull request Oct 13, 2025

CNTRLPLANE-1544: manifests: Enable user namespace for the operator openshift/cloud-credential-operator#927

Merged

openshift-ci bot assigned p0lyn0mial Oct 15, 2025

openshift-ci bot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Oct 15, 2025

openshift-ci bot removed lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Oct 15, 2025

tchap mentioned this pull request Oct 15, 2025

CNTRLPLANE-1544: tests: authorization/rbac: Add restricted-v3 scc openshift/origin#30384

Merged

openshift-ci bot changed the title ~~scc: give all authenticated users access to restricted-v3~~ NO-JIRA: scc: give all authenticated users access to restricted-v3 Oct 16, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Oct 16, 2025

tchap mentioned this pull request Oct 20, 2025

CNTRLPLANE-1544: scc: Grant authenticated users use of restricted-v3 #1944

Merged

openshift-ci bot assigned benluddy Oct 24, 2025

openshift-ci bot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Oct 24, 2025

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 24, 2025

openshift-ci bot closed this Oct 24, 2025

openshift-ci bot removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 24, 2025

NO-JIRA: scc: give all authenticated users access to restricted-v3 #1935

NO-JIRA: scc: give all authenticated users access to restricted-v3 #1935

Uh oh!

Conversation

haircommander commented Oct 8, 2025

Uh oh!

coderabbitai bot commented Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Pre-merge checks and finishing touches

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

haircommander Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

haircommander commented Oct 8, 2025

Uh oh!

tchap commented Oct 9, 2025

Uh oh!

haircommander commented Oct 9, 2025

Uh oh!

tchap commented Oct 13, 2025

Uh oh!

tchap commented Oct 14, 2025

Uh oh!

tchap commented Oct 14, 2025

Uh oh!

tchap commented Oct 15, 2025

Uh oh!

p0lyn0mial commented Oct 15, 2025

Uh oh!

p0lyn0mial commented Oct 15, 2025

Uh oh!

openshift-ci bot commented Oct 15, 2025

Uh oh!

openshift-ci bot commented Oct 16, 2025

Uh oh!

openshift-ci bot commented Oct 16, 2025

Uh oh!

tchap commented Oct 16, 2025

Uh oh!

openshift-ci-robot commented Oct 16, 2025

Uh oh!

tchap commented Oct 16, 2025

Uh oh!

openshift-ci bot commented Oct 16, 2025

Uh oh!

tchap commented Oct 16, 2025

Uh oh!

tchap commented Oct 17, 2025

Uh oh!

benluddy commented Oct 24, 2025

Uh oh!

benluddy commented Oct 24, 2025

Uh oh!

openshift-ci bot commented Oct 24, 2025

Uh oh!

openshift-ci bot commented Oct 24, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

coderabbitai bot commented Oct 8, 2025 •

edited

Loading

coderabbitai bot Oct 8, 2025 •

edited

Loading