View Issue Details

IDProjectCategoryView StatusLast Update
0017548administrationenhancepublic2020-06-29 16:12
Reporterastepano 
PriorityhighSeverityminorReproducibilityalways
Status newResolutionopen 
Product Version 
Target VersionFixed in Version 
Summary0017548: OCP4 : ocp.ci.centos.org , please grant to "fedora-ci-admins" right to manage "events" in namespace: "fedora-ci"
DescriptionHello, this ticket is about OCP4: ocp.ci.centos.org.

We want to specify FQDN for routes .
Services can be exposed securely with: https://xxx-fedora-ci.apps.ocp.ci.centos.org
We need to use ACME/letsencrypt service that issues certificates for routes with https://FQDN.
There is tool for this: https://github.com/tnozicka/openshift-acme

The tool can be installed in different ways: 1) for cluster 2) for namespace.

I am trying to install the tool into our namespace: fedora-ci
But, I cannot create role for our namespace: https://github.com/tnozicka/openshift-acme/blob/master/deploy/specific-namespaces/role.yaml

The error at this step is:

Error: roles.rbac.authorization.k8s.io "acme-openshift-acme" is forbidden: user "astepano@redhat.com" (groups=["fedora-ci-admins" "system:authenticated:oauth" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
{APIGroups:[""], Resources:["events"], Verbs:["create" "update" "patch"]}

Please grant permission to "fedora-ci-admins" create that role for our namespace.

Thank you! Regards!
TagsNo tags attached.

Activities

astepano

astepano

2020-06-29 15:47

reporter   ~0037253

Because we manage resources in automatic way, it would be great that we have permission to create/remove the above role with our credentials.
astepano

astepano

2020-06-29 16:12

reporter   ~0037256

Please close this ticket. I created the same one in Centos-CI namespace: https://bugs.centos.org/view.php?id=17549

Issue History

Date Modified Username Field Change
2020-06-29 15:44 astepano New Issue
2020-06-29 15:47 astepano Note Added: 0037253
2020-06-29 16:12 astepano Note Added: 0037256