ods-core
ods-core copied to clipboard
rolebinding admin lost when cloning environment
oc new-project <project-name>
creates a role binding with name admin
, for example (abbreviated):
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: admin
namespace: autst-feature-16
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: admin
subjects:
- kind: ServiceAccount
name: jenkins
namespace: autst-cd
When using oc apply
the role binding named admin
in rolebinding.yaml
(exported from the cloned environment, here autst-dev) wins and replaces the role binding above.
This means jenkins itself no longer has admin provisions and fails fatally.
The import script is using oc create --save-config ...
(https://github.com/opendevstack/ods-project-quickstarters/blob/17e530e7b623625bce38933c5ed242462cd7166e/ocp-templates/scripts/import_ocp_project_metadata.sh#L491) to avoid the issue above.
However, the existing rolebinding created by new-project is not overwritten. But the rolebinding named admin
from rolebinding.yaml gets lost.