{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/ansible-service-broker/issues/715","repository_url":"https://api.github.com/repos/openshift/ansible-service-broker","labels_url":"https://api.github.com/repos/openshift/ansible-service-broker/issues/715/labels{/name}","comments_url":"https://api.github.com/repos/openshift/ansible-service-broker/issues/715/comments","events_url":"https://api.github.com/repos/openshift/ansible-service-broker/issues/715/events","html_url":"https://github.com/openshift/ansible-service-broker/issues/715","id":293267884,"node_id":"MDU6SXNzdWUyOTMyNjc4ODQ=","number":715,"title":"Enable access to cluster roles when auto_escalate is true","user":{"login":"rthallisey","id":6795213,"node_id":"MDQ6VXNlcjY3OTUyMTM=","avatar_url":"https://avatars2.githubusercontent.com/u/6795213?v=4","gravatar_id":"","url":"https://api.github.com/users/rthallisey","html_url":"https://github.com/rthallisey","followers_url":"https://api.github.com/users/rthallisey/followers","following_url":"https://api.github.com/users/rthallisey/following{/other_user}","gists_url":"https://api.github.com/users/rthallisey/gists{/gist_id}","starred_url":"https://api.github.com/users/rthallisey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rthallisey/subscriptions","organizations_url":"https://api.github.com/users/rthallisey/orgs","repos_url":"https://api.github.com/users/rthallisey/repos","events_url":"https://api.github.com/users/rthallisey/events{/privacy}","received_events_url":"https://api.github.com/users/rthallisey/received_events","type":"User","site_admin":false},"labels":[{"id":799588031,"node_id":"MDU6TGFiZWw3OTk1ODgwMzE=","url":"https://api.github.com/repos/openshift/ansible-service-broker/labels/3.10%20%7C%20release-1.2","name":"3.10 | release-1.2","color":"ff5beb","default":false},{"id":623309155,"node_id":"MDU6TGFiZWw2MjMzMDkxNTU=","url":"https://api.github.com/repos/openshift/ansible-service-broker/labels/feature","name":"feature","color":"1d76db","default":false}],"state":"closed","locked":false,"assignee":{"login":"rthallisey","id":6795213,"node_id":"MDQ6VXNlcjY3OTUyMTM=","avatar_url":"https://avatars2.githubusercontent.com/u/6795213?v=4","gravatar_id":"","url":"https://api.github.com/users/rthallisey","html_url":"https://github.com/rthallisey","followers_url":"https://api.github.com/users/rthallisey/followers","following_url":"https://api.github.com/users/rthallisey/following{/other_user}","gists_url":"https://api.github.com/users/rthallisey/gists{/gist_id}","starred_url":"https://api.github.com/users/rthallisey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rthallisey/subscriptions","organizations_url":"https://api.github.com/users/rthallisey/orgs","repos_url":"https://api.github.com/users/rthallisey/repos","events_url":"https://api.github.com/users/rthallisey/events{/privacy}","received_events_url":"https://api.github.com/users/rthallisey/received_events","type":"User","site_admin":false},"assignees":[{"login":"rthallisey","id":6795213,"node_id":"MDQ6VXNlcjY3OTUyMTM=","avatar_url":"https://avatars2.githubusercontent.com/u/6795213?v=4","gravatar_id":"","url":"https://api.github.com/users/rthallisey","html_url":"https://github.com/rthallisey","followers_url":"https://api.github.com/users/rthallisey/followers","following_url":"https://api.github.com/users/rthallisey/following{/other_user}","gists_url":"https://api.github.com/users/rthallisey/gists{/gist_id}","starred_url":"https://api.github.com/users/rthallisey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rthallisey/subscriptions","organizations_url":"https://api.github.com/users/rthallisey/orgs","repos_url":"https://api.github.com/users/rthallisey/repos","events_url":"https://api.github.com/users/rthallisey/events{/privacy}","received_events_url":"https://api.github.com/users/rthallisey/received_events","type":"User","site_admin":false}],"milestone":null,"comments":6,"created_at":"2018-01-31T18:41:12Z","updated_at":"2018-09-20T02:14:11Z","closed_at":"2018-02-01T20:52:41Z","author_association":"CONTRIBUTOR","body":"# Feature:\r\nCurrently the broker does not allow an apb to have access to anything outside it's own namespace (defined as cluster resources).  The goal of this feature is to provide developers the ability to give their apbs full access to the cluster without restrictions for testing purposes.\r\n\r\nWhen we turn on auto_escalate, we no longer audit whether a user has permission to launch an apb with the sandbox_role.  This allows the user full control over a namespace.  I'm proposing that when  auto_escalate is on, that we give a user full control over the cluster.  Auto_escalate is not a production setting, so it won't affect security for anything other than developer environments where security is not a priority.\r\n\r\nAnother option would be to add an additional flag like ```cluster_access```, which would require we turn on both ```cluster_access``` and ```auto_escalate``` to give a apbs full access to the cluster.\r\n\r\n# non-goal:\r\nThis feature is not meant to address the problem for production environments.  I think production environments require the admin to have more oversight on what cluster level apbs are allowed to run.  This will be addressed in the future."},"comment":{"url":"https://api.github.com/repos/openshift/ansible-service-broker/issues/comments/423017067","html_url":"https://github.com/openshift/ansible-service-broker/issues/715#issuecomment-423017067","issue_url":"https://api.github.com/repos/openshift/ansible-service-broker/issues/715","id":423017067,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMzAxNzA2Nw==","user":{"login":"tj13","id":14867953,"node_id":"MDQ6VXNlcjE0ODY3OTUz","avatar_url":"https://avatars2.githubusercontent.com/u/14867953?v=4","gravatar_id":"","url":"https://api.github.com/users/tj13","html_url":"https://github.com/tj13","followers_url":"https://api.github.com/users/tj13/followers","following_url":"https://api.github.com/users/tj13/following{/other_user}","gists_url":"https://api.github.com/users/tj13/gists{/gist_id}","starred_url":"https://api.github.com/users/tj13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tj13/subscriptions","organizations_url":"https://api.github.com/users/tj13/orgs","repos_url":"https://api.github.com/users/tj13/repos","events_url":"https://api.github.com/users/tj13/events{/privacy}","received_events_url":"https://api.github.com/users/tj13/received_events","type":"User","site_admin":false},"created_at":"2018-09-20T02:14:11Z","updated_at":"2018-09-20T02:14:11Z","author_association":"NONE","body":"> To follow up on this, I think we're going to use Karim's workaround which is to sign into cluster from the apb.\r\n> https://github.com/karmab/kubevirt-apb/blob/master/roles/kubevirt-apb/tasks/provision.yml#L3-L9\r\n> \r\n> Closing this issue. A proposal will follow at a later date to address this problem for production deployments.\r\n\r\n@rthallisey the link is broken. any tips how to create  project in an apb?"}}
{"actor":{"display_login":"tj13"}}