Some system roles missing authorization.openshift.io/system-only annotation

[spadgett]

Some roles are showing up in the web console membership page that probably shouldn't because they're missing the authorization.openshift.io/system-only annotation. See

service-catalog-controller shouldn't be there and maybe some others. The console will hide roles with that annotation unless a "Show system roles" checkbox is checked.

cc @benjaminapetersen @enj @pmorie

Version

oc v3.7.0-alpha.1+572fb85-1047
kubernetes v1.7.6+a08f5eeb62
features: Basic-Auth

Server https://127.0.0.1:8443
openshift v3.7.0-alpha.1+572fb85-1047
kubernetes v1.7.6+a08f5eeb62

[enj]

Sounds like the roles in examples/service-catalog/service-catalog.yaml need to be updated to have the annotation.

[benjaminapetersen]

I think this made sense back when we first introduced it, but it seems like there are too many parties adding roles now to keep up. It might make sense to go back to a whitelist of roles in the config file of the console (or we just hard-code it in the membership module), and allow role authors to add an annotation to userFacing: true to add to this whitelist.

[liggitt]

+1 for whitelist. you will never get all role creators to annotate.

[benjaminapetersen]

Back to where we started :)

[jwforres]

should we be whitelisting on the roles using an annotation, or whitelisting in the console using an extension with sane defaults

[benjaminapetersen]

Perhaps just a list in config.js?

[jwforres]

@benjaminapetersen wouldn't be in config.js, it would be in constants.js if we do it in the console code. I'm fine with going back to that. Just means @enj needs to let us know when there is a new default role that makes sense to expose to users. I expect this will not be often...

[benjaminapetersen]

Sorry, meant constants.js, yup!

[spadgett]

Looks like sar-creator and namespace-viewer are also coming from the service-catalog template, too.

[benjaminapetersen]

History:

• issue Influx of roles w/o systemOnly annotation #14411
• PR Annotate roles with systemOnly #14510,
• PR Additional roles missing system-only annotation #15241

[enj]

@benjaminapetersen please open an origin PR for 3.8 to gut all the system-only stuff.