CNTRLPLANE-1544: tests: authorization/rbac: Add restricted-v3 scc

[tchap]

We need to include restricted-v3 scc in the list of rules for
authenticated users, but iff the associated ClusterRoleBinding exists.

This is a temporary and conditional fix to make tests passing for

openshift/cluster-kube-apiserver-operator#1944

A subsequent PR is gonna be opened once the PR above is merged.

[openshift-ci-robot]

@tchap: This pull request explicitly references no jira issue.

In response to this:

Add "use restricted-v3 scc" to the list of expected rules for authenticated users.

Needed for openshift/cluster-kube-apiserver-operator#1935

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tchap]

/payload-job-with-prs pull-ci-openshift-cluster-kube-apiserver-operator-main-e2e-aws openshift/cluster-kube-apiserver-operator#1935

[openshift-ci]

@tchap: it appears that you have attempted to use some version of the payload command, but your comment was incorrectly formatted and cannot be acted upon. See the docs for usage info.

[tchap]

/payload-job-with-prs pull-ci-openshift-cluster-kube-apiserver-operator-main-e2e-aws openshift/cluster-kube-apiserver-operator#1935

[openshift-ci]

@tchap: trigger 0 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

[tchap]

/payload-job-with-prs ci/prow/e2e-aws-ovn openshift/cluster-kube-apiserver-operator#1935

[openshift-ci]

@tchap: it appears that you have attempted to use some version of the payload command, but your comment was incorrectly formatted and cannot be acted upon. See the docs for usage info.

[tchap]

/payload-job-with-prs pull-ci-openshift-origin-main-e2e-vsphere-ovn-upi openshift/cluster-kube-apiserver-operator#1935

[openshift-ci]

@tchap: trigger 0 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

[tchap]

/testwith openshift/cluster-kube-apiserver-operator#1935

[tchap]

/payload-with-prs openshift/cluster-kube-apiserver-operator#1935

[openshift-ci]

@tchap: it appears that you have attempted to use some version of the payload command, but your comment was incorrectly formatted and cannot be acted upon. See the docs for usage info.

[tchap]

/payload-with-prs openshift/cluster-kube-apiserver-operator#1935

[openshift-ci]

@tchap: it appears that you have attempted to use some version of the payload command, but your comment was incorrectly formatted and cannot be acted upon. See the docs for usage info.

[tchap]

/test-with openshift/cluster-kube-apiserver-operator#1935

[tchap]

/payload-with-prs 4.21 ci openshift/cluster-kube-apiserver-operator#1935

[openshift-ci]

@tchap: it appears that you have attempted to use some version of the payload command, but your comment was incorrectly formatted and cannot be acted upon. See the docs for usage info.

[tchap]

/payload-with-prs 4.21 ci all openshift/cluster-kube-apiserver-operator#1935

[openshift-ci]

@tchap: An error was encountered. No known errors were detected, please see the full error message for details.

Full error message.

could not resolve jobs for 4.21 ci all: failed to request latest release: server responded with 400: error: jobType must be one of '', 'informing', 'blocking', 'disabled' or 'periodic'

Please contact an administrator to resolve this issue.

[tchap]

/payload-with-prs 4.21 ci all informing openshift/cluster-kube-apiserver-operator#1935

[openshift-ci]

@tchap: An error was encountered. No known errors were detected, please see the full error message for details.

Full error message.

could not resolve jobs for 4.21 ci all: failed to request latest release: server responded with 400: error: jobType must be one of '', 'informing', 'blocking', 'disabled' or 'periodic'

Please contact an administrator to resolve this issue.

[tchap]

/payload-with-prs 4.21 ci informing openshift/cluster-kube-apiserver-operator#1935

[openshift-ci]

@tchap: trigger 1 job(s) of type informing for the ci release of OCP 4.21

• periodic-ci-openshift-release-master-ci-4.21-upgrade-from-stable-4.20-e2e-aws-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/d6b1e380-aa85-11f0-95a7-712e44658b77-0

[tchap]

/retest

[openshift-ci]

@tchap: This PR was included in a payload test run from openshift/cluster-kube-apiserver-operator#1935
trigger 1 job(s) of type informing for the ci release of OCP 4.21

• periodic-ci-openshift-release-master-ci-4.21-upgrade-from-stable-4.20-e2e-aws-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/33e53000-aaa1-11f0-86f9-7907cfa77396-0

[tchap]

/retest

[openshift-ci-robot]

@tchap: This pull request references CNTRLPLANE-1544 which is a valid jira issue.

In response to this:

We need to include restricted-v3 scc in the list of rules for
authenticated users, but iff the associated ClusterRoleBinding exists.

This is a temporary and conditional fix to make tests passing for

openshift/cluster-kube-apiserver-operator#1944

A subsequent PR is gonna be opened once the PR above is merged.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@tchap: This PR was included in a payload test run from openshift/cluster-kube-apiserver-operator#1944
trigger 1 job(s) of type informing for the ci release of OCP 4.21

• periodic-ci-openshift-release-master-ci-4.21-upgrade-from-stable-4.20-e2e-aws-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/b2df3500-af37-11f0-812a-d5b1ae1849ed-0

[tchap]

/retest-required

[liouk]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liouk, tchap

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• test/extended/authorization/OWNERS [liouk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tchap]

/verified by "[sig-auth][Feature:OpenShiftAuthorization] The default cluster RBAC policy should have correct RBAC rules"

[openshift-ci-robot]

@tchap: This PR has been marked as verified by "[sig-auth][Feature:OpenShiftAuthorization] The default cluster RBAC policy should have correct RBAC rules".

In response to this:

/verified by "[sig-auth][Feature:OpenShiftAuthorization] The default cluster RBAC policy should have correct RBAC rules"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 0734d3a and 2 for PR HEAD b39fa71 in total

[openshift-trt]

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: b39fa71

Job Name	New Test Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift	High - "Import the release payload "nightly-arm64" from an external source" is a new test that was not present in all runs against the current commit.
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift-serial	High - "Import the release payload "nightly-arm64" from an external source" is a new test that was not present in all runs against the current commit.

New tests seen in this PR at sha: b39fa71

• "Import the release payload "nightly-arm64" from an external source" [Total: 4, Pass: 4, Fail: 0, Flake: 0]

[openshift-trt]

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: b39fa71

Job Name	New Test Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift	High - "Import the release payload "nightly-arm64" from an external source" is a new test that was not present in all runs against the current commit.
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift-serial	High - "Import the release payload "nightly-arm64" from an external source" is a new test that was not present in all runs against the current commit.

New tests seen in this PR at sha: b39fa71

• "Import the release payload "nightly-arm64" from an external source" [Total: 4, Pass: 4, Fail: 0, Flake: 0]

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD d629cf1 and 1 for PR HEAD b39fa71 in total

[openshift-ci]

@tchap: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-aws-ovn	b39fa71	link	false	/test okd-scos-e2e-aws-ovn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-trt]

Job Failure Risk Analysis for sha: b39fa71

Job Name	Failure Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-serial-2of2	IncompleteTests Tests for this run (25) are below the historical average (1668): IncompleteTests (not enough tests ran to make a reasonable risk analysis; this could be due to infra, installation, or upgrade problems)

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: b39fa71

Job Name	New Test Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift	High - "Import the release payload "nightly-arm64" from an external source" is a new test that was not present in all runs against the current commit.
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift-serial	High - "Import the release payload "nightly-arm64" from an external source" is a new test that was not present in all runs against the current commit.

New tests seen in this PR at sha: b39fa71

• "Import the release payload "nightly-arm64" from an external source" [Total: 4, Pass: 4, Fail: 0, Flake: 0]

[openshift-trt]

Job Failure Risk Analysis for sha: b39fa71

Job Name	Failure Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-serial-2of2	IncompleteTests Tests for this run (25) are below the historical average (1666): IncompleteTests (not enough tests ran to make a reasonable risk analysis; this could be due to infra, installation, or upgrade problems)

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: b39fa71

Job Name	New Test Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift	High - "Import the release payload "nightly-arm64" from an external source" is a new test that was not present in all runs against the current commit.
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift-serial	High - "Import the release payload "nightly-arm64" from an external source" is a new test that was not present in all runs against the current commit.

New tests seen in this PR at sha: b39fa71

• "Import the release payload "nightly-arm64" from an external source" [Total: 4, Pass: 4, Fail: 0, Flake: 0]

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 450d258 and 0 for PR HEAD b39fa71 in total

[haircommander]

/cherry-pick release-4.20

[openshift-cherrypick-robot]

@haircommander: new pull request created: #30502

In response to this:

/cherry-pick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.