OCPBUGS-63305: Make SimulatePrincipalPolicy optional - #10081
Conversation
openshift-ci-robot
added
jira/valid-reference
|
@barbacbd: This pull request references Jira Issue OCPBUGS-63305, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/cc @tthvo |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@barbacbd: This pull request references Jira Issue OCPBUGS-63305, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Looks like have a tiny problem 🤔 related to #10081 (comment). Jobs are failing with: |
12cd06c to
991c8a0
Compare
|
/retest-required |
|
/approve |
openshift-ci
Bot
added
the
approved
|
/hold It seems CCO does require this: https://redhat-internal.slack.com/archives/C68TNFWA2/p1763145109506449?thread_ts=1760641140.491929&cid=C68TNFWA2 |
openshift-ci
Bot
added
the
do-not-merge/hold
|
/cc @jstuever |
|
I read through the CCO code more... The 2 places in the actuator where the permission check is called here: actuator.go#L280 and actuator.go#L488. I tried so many ways (i.e. all with
My expectation is that if those lines were ever called, we would see a Cloud Trail event regardless of success or Auth error. There is none ❌ The installation completes successfully all the times with a happy CCO and all Maybe we are missing something, but CCO doesn't seem to perform any permission checks in explicitly Mint mode at all? |
|
/jira refresh |
|
@gpei: This pull request references Jira Issue OCPBUGS-63305, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Removing SimulatePrincipalPolicy as a required permission for Mint and Passthrough modes. Instead it will be required when a credential mode is not set.
991c8a0 to
6f9176e
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: patrickdillon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@deepsm007: The The following commands are available to trigger optional jobs: Use DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/test all |
|
/retest |
|
@barbacbd: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
tthvo
left a comment
tthvo
left a comment
There was a problem hiding this comment.
/lgtm
IIUC, the latest commit removes the iam:SimulatePrincipalPolicy requirement for Manual and Passthrough credentials mode while keep it for MintMode or default empty.
I am unsure if we need to also remove it for Mint mode as in #10081 (comment). But we can definitely remove it later if so.
|
@tthvo I'm not sure if the previously described cases cover a situation where policy simulation would be called. For Passthrough, it is only called from the For Mint, it is only called from the |
|
/jira refresh The requirements for Jira bugs have changed (Jira issues linked to PRs on main branch need to target different OCP), recalculating validity. |
openshift-ci-robot
added
jira/invalid-bug
|
@openshift-bot: This pull request references Jira Issue OCPBUGS-63305, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
the
jira/valid-bug
|
@tthvo: This pull request references Jira Issue OCPBUGS-63305, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
removed
the
jira/invalid-bug
|
/jira refresh The requirements for Jira bugs have changed (Jira issues linked to PRs on main branch need to target different OCP), recalculating validity. |
|
@openshift-bot: This pull request references Jira Issue OCPBUGS-63305, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/hold cancel |
openshift-ci
Bot
removed
the
do-not-merge/hold
|
/payload-job periodic-ci-openshift-openshift-tests-private-release-4.22-amd64-nightly-aws-ipi-private-shared-vpc-phz-sts-mini-perm-f7 |
|
@yunjiang29: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/fb428aa0-fb21-11f0-8abd-0d005f83d878-0 |
|
/payload-job periodic-ci-openshift-openshift-tests-private-release-4.22-arm64-nightly-aws-ipi-disc-priv-sts-ep-mini-perm-f14 |
|
@yunjiang29: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/bfe71c20-fb38-11f0-9cec-028e182b7ed6-0 |
|
/verified by @yunjiang29 |
openshift-ci-robot
added
the
verified
|
@yunjiang29: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
cbe2b67
into
openshift:main
|
@barbacbd: Jira Issue Verification Checks: Jira Issue OCPBUGS-63305 Jira Issue OCPBUGS-63305 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Fix included in accepted release 4.22.0-0.nightly-2026-01-28-225830 |
10 participants
Removing SimulatePrincipalPolicy as a required permission for Mint and Passthrough modes. Instead it will be required when a credential mode is not set.