Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Doc needs update for security context #20

Open
swpoulin opened this issue Nov 20, 2021 · 1 comment
Open

Doc needs update for security context #20

swpoulin opened this issue Nov 20, 2021 · 1 comment
Assignees

Comments

@swpoulin
Copy link

I edited the cr.yaml to add a few more targets, at start up the tc8-operator pod log reported:
Unable to continue with install: could not get information about the resource:
clusterrolebindings.rbac.authorization.k8s.io "turbo-all-binding"
is forbidden:
User "system:serviceaccount:turbonomic:t8c-operator" cannot get resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.10.0/pkg/internal/controller/controller.go:227"}

I found I had to do both commands below to get past this:
oc adm policy add-scc-to-group anyuid system:serviceaccounts:turbonomic
oc create clusterrolebinding turbonomic-admin --clusterrole=cluster-admin --serviceaccount=turbonomic:t8c-operator

@esara
Copy link
Contributor

esara commented Nov 20, 2021

@swpoulin the t8c-operator is intended to install the turbonomic platform only on Openshift with minimal/required permissions
for security context, please refer to https://github.com/turbonomic/t8c-install/wiki/4.-Turbonomic-Multinode-Deployment-Steps#openshift-security-context

kubeturbo should be installed using the kubeturbo-operator instead of adding cluster admin to the turbonomic operator, for documentation please refer to https://github.com/turbonomic/kubeturbo/wiki/OpenShift-Operator-Hub-Details

@esara esara self-assigned this Nov 20, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants