Fix: stop rendering duplicate rossoctl-authbridge SCC (rossoctl#2354) - #506
Merged
Conversation
…l#2354) The chart rendered a second rossoctl-authbridge SCC + its "use" ClusterRole that duplicate and conflict with the ones the rossoctl platform chart has shipped since March, blocking OpenShift install (rossoctl#2354). The platform's SCC is a strict superset (identical volumes incl. csi; more permissive only where the injected proxy-init needs NET_ADMIN/NET_RAW/root), so dropping this copy loses nothing and also fixes the agent-pod admission failure. Retain the operator-SA -> SCC ClusterRoleBinding (roleRef resolves to the platform's ClusterRole of the same name) so ensureNamespaceSCCBinding delegation keeps working. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: cwiklik <cwiklikj@gmail.com>
cwiklik
changed the title
evaline-ju
approved these changes
Aug 11, 2026
evaline-ju
left a comment
evaline-ju
left a comment
Contributor
There was a problem hiding this comment.
might be good to highlight the standalone/maintainer decision point in the next release, especially if it affects current install paths?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the OpenShift install-blocker rossoctl/rossoctl#2354.
This chart rendered a second
rossoctl-authbridgeSCC (+ itsuseClusterRole) that duplicates and conflicts with the ones the rossoctl platform chart has shipped since 2026-03-27. In a combined rossoctl install (this chart is pulled as a subchart), two docs declare the same cluster-scoped SCC → Helm merge-patch adoption fails on OpenShift → install hard-blocks. Even when de-duped to this chart's spec, agent pods then fail admission because this spec is restrictive (MustRunAsNonRoot,allowedCapabilities:[], dropALL) and can't admit the injectedproxy-init(NET_ADMIN/NET_RAW, root).The platform chart's SCC is a strict superset — identical
volumes(incl.csifor SPIRE), and more permissive only whereproxy-initrequires it — so dropping this chart's copy loses nothing and also fixes the admission failure.Change
charts/operator/templates/rbac/authbridge-scc.yaml:SecurityContextConstraintsand thesystem:openshift:scc:rossoctl-authbridgeClusterRole (both owned by the platform chart).ClusterRoleBindinggranting the operator SAuseof the SCC — itsroleRefresolves to the platform-provided ClusterRole of the same name, soensureNamespaceSCCBinding's per-namespace delegation keeps working without an RBAC privilege-escalation error.Net in a combined install: exactly one (permissive, platform) SCC + one ClusterRole; operator retains delegation. No new permissions vs v0.6.1.
Standalone note (maintainer decision)
If this chart is meant to be installed standalone on OpenShift (without the platform chart), it still needs its own SCC. In that case, prefer gating the removed objects behind a
scc.createvalue (defaulttrue) that rossoctl setsfalse, and make the standalone SCC spec permissive — rather than deleting outright. Happy to switch to that approach if standalone-via-Helm on OCP is a supported path. (The kustomizeconfig/security/rossoctl-authbridge-scc.yamlpath is unaffected.)Rollout
After merge: cut a new operator-chart release → re-pin
operator-chartinrossoctlcharts/rossoctl/Chart.yaml+helm dependency update.Refs rossoctl/rossoctl#2354. Context (regression trace + field-by-field SCC comparison) in that issue.
Assisted-By: Claude Code