Disabling the self-provisioners role

Disabling self-provisioners role

By default, when a user authenticates with Openshift via Oauth, it is part of the self-provisioners group. This group provides the ability to create new projects. On CentOS CI we do not want users to be able to create their own projects, as we have a system in place where we create a project and control the administrators of that project.

To disable the self-provisioner role do the following as outlined in the documentation[1].

oc describe clusterrolebinding.rbac self-provisioners

Name:       self-provisioners
Labels:     <none>
Annotations:    rbac.authorization.kubernetes.io/autoupdate=true
Role:
  Kind: ClusterRole
  Name: self-provisioner
Subjects:
  Kind  Name                Namespace
  ----  ----                ---------
  Group system:authenticated:oauth

Remove the subjects that the self-provisioners role applies to.

oc patch clusterrolebinding.rbac self-provisioners -p '{"subjects": null}'

Verify the change occurred successfully

oc describe clusterrolebinding.rbac self-provisioners
Name:         self-provisioners
Labels:       <none>
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
Role:
  Kind:  ClusterRole
  Name:  self-provisioner
Subjects:
  Kind  Name  Namespace
  ----  ----  ---------

When the cluster is updated to a new version, unless we mark the role appropriately, the permissions will be restored after the update is complete.

Verify that the value is currently set to be restored after an update:

oc get clusterrolebinding.rbac self-provisioners -o yaml

apiVersion: authorization.openshift.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  ...

We wish to set this rbac.authorization.kubernetes.io/autoupdate to false. To patch this do the following.

oc patch clusterrolebinding.rbac self-provisioners -p '{ "metadata": { "annotations": { "rbac.authorization.kubernetes.io/autoupdate": "false" } } }'

Resources

• [1] https://docs.openshift.com/container-platform/4.4/applications/projects/configuring-project-creation.html#disabling-project-self-provisioning_configuring-project-creation