Re-add finalizer update RBAC for VM export #12813
Conversation
Basically, OpenShift deploys enforcement that says we `cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on` https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement We recently removed this rbac unintentionally in kubevirt@dc6b76f. Signed-off-by: Alex Kalenyuk <akalenyu@redhat.com>
kubevirt-bot
added
release-note
|
/cc @mhenriks |
|
@akalenyu: The following test failed, say
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: alicefr The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
kubevirt-bot
added
the
approved
|
/lgtm |
|
Required labels detected, running phase 2 presubmits: |
|
/retest-required |
What this PR does
Basically, OpenShift deploys enforcement that says we
cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers onhttps://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcementWe recently removed this rbac unintentionally in dc6b76f.
Fixes #
Why we need it and why it was done in this way
The following tradeoffs were made:
The following alternatives were considered:
Links to places where the discussion took place:
Special notes for your reviewer
Checklist
This checklist is not enforcing, but it's a reminder of items that could be relevant to every PR.
Approvers are expected to review this list.
Release note