clusterroles.rbac.authorization.k8s.io "rook-operator" is forbidden: attempt to grant extra privileges:

[debianmaster]

I'm trying to create a rook.io storage cluster on openshift master branch version as of today.
And seeing following error

Version

oc v3.6.0-alpha.1+f24a57f-496
kubernetes v1.6.1+5115d708d7
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://34.209.8.118.nip.io:8443
openshift v3.6.0-alpha.1+f24a57f-496
kubernetes v1.6.1+5115d708d7

Steps To Reproduce

git clone https://github.com/rook/rook.git
cd rook
oc new-project rook
oc adm policy add-cluster-role-to-user cluster-admin system:serviceaccount:rook:rook-api
oc adm policy add-cluster-role-to-user cluster-admin system:serviceaccount:default:rook-operator
oc adm policy add-cluster-role-to-user cluster-admin system:serviceaccount:rook:default
oc adm policy add-scc-to-user anyuid -z default -n rook
oc adm policy add-scc-to-user privileged -z default -n rook
oc create -f demo/kubernetes/rook-operator.yaml

Current Result

Error from server (Forbidden): error when creating "demo/kubernetes/rook-operator.yaml": clusterroles.rbac.authorization.k8s.io "rook-operator" is forbidden: attempt to grant extra privileges: [{[get] [] [namespaces] [] []} {[list] [] [namespaces] [] []} {[watch] [] [namespaces] [] []} {[create] [] [namespaces] [] []} {[update] [] [namespaces] [] []} {[get] [] [serviceaccounts] [] []} {[list] [] [serviceaccounts] [] []} {[watch] [] [serviceaccounts] [] []} {[create] [] [serviceaccounts] [] []} {[update] [] [serviceaccounts] [] []} {[get] [] [secrets] [] []} {[list] [] [secrets] [] []} {[watch] [] [secrets] [] []} {[create] [] [secrets] [] []} {[update] [] [secrets] [] []} {[get] [] [pods] [] []} {[list] [] [pods] [] []} {[watch] [] [pods] [] []} {[create] [] [pods] [] []} {[update] [] [pods] [] []} {[get] [] [services] [] []} {[list] [] [services] [] []} {[watch] [] [services] [] []} {[create] [] [services] [] []} {[update] [] [services] [] []} {[get] [] [nodes] [] []} {[list] [] [nodes] [] []} {[watch] [] [nodes] [] []} {[create] [] [nodes] [] []} {[update] [] [nodes] [] []} {[get] [] [configmaps] [] []} {[list] [] [configmaps] [] []} {[watch] [] [configmaps] [] []} {[create] [] [configmaps] [] []} {[update] [] [configmaps] [] []} {[get] [] [events] [] []} {[list] [] [events] [] []} {[watch] [] [events] [] []} {[create] [] [events] [] []} {[update] [] [events] [] []} {[get] [] [persistentvolumes] [] []} {[list] [] [persistentvolumes] [] []} {[watch] [] [persistentvolumes] [] []} {[create] [] [persistentvolumes] [] []} {[update] [] [persistentvolumes] [] []} {[get] [] [persistentvolumeclaims] [] []} {[list] [] [persistentvolumeclaims] [] []} {[watch] [] [persistentvolumeclaims] [] []} {[create] [] [persistentvolumeclaims] [] []} {[update] [] [persistentvolumeclaims] [] []} {[get] [extensions] [thirdpartyresources] [] []} {[list] [extensions] [thirdpartyresources] [] []} {[watch] [extensions] [thirdpartyresources] [] []} {[create] [extensions] [thirdpartyresources] [] []} {[get] [extensions] [deployments] [] []} {[list] [extensions] [deployments] [] []} {[watch] [extensions] [deployments] [] []} {[create] [extensions] [deployments] [] []} {[get] [extensions] [daemonsets] [] []} {[list] [extensions] [daemonsets] [] []} {[watch] [extensions] [daemonsets] [] []} {[create] [extensions] [daemonsets] [] []} {[get] [extensions] [replicasets] [] []} {[list] [extensions] [replicasets] [] []} {[watch] [extensions] [replicasets] [] []} {[create] [extensions] [replicasets] [] []} {[get] [rbac.authorization.k8s.io] [clusterroles] [] []} {[list] [rbac.authorization.k8s.io] [clusterroles] [] []} {[watch] [rbac.authorization.k8s.io] [clusterroles] [] []} {[create] [rbac.authorization.k8s.io] [clusterroles] [] []} {[update] [rbac.authorization.k8s.io] [clusterroles] [] []} {[get] [rbac.authorization.k8s.io] [clusterrolebindings] [] []} {[list] [rbac.authorization.k8s.io] [clusterrolebindings] [] []} {[watch] [rbac.authorization.k8s.io] [clusterrolebindings] [] []} {[create] [rbac.authorization.k8s.io] [clusterrolebindings] [] []} {[update] [rbac.authorization.k8s.io] [clusterrolebindings] [] []} {[get] [storage.k8s.io] [storageclasses] [] []} {[list] [storage.k8s.io] [storageclasses] [] []} {[watch] [storage.k8s.io] [storageclasses] [] []} {[*] [rook.io] [*] [] []}] user=&{system:admin  [system:cluster-admins system:authenticated] map[]} ownerrules=[{[create] [authorization.k8s.io] [selfsubjectaccessreviews] [] []} {[get] [] [] [] [/api /api/* /apis /apis/* /healthz /swaggerapi /swaggerapi/* /version]}] ruleResolutionErrors=[]

Expected Result

operation should succeed and a pod should be created.

[enj]

@deads2k would #14064 fix this? The rule coverage is failing since kube RBAC is not aware of the * * * that applies to cluster admin.

@debianmaster I suggest converting those resources into the origin equivalents, either by hand or something like this.

[deads2k]

kube RBAC rules aren't respected and will be deleted/stomped to match openshift RBAC resources.

[enj]

@debianmaster based on @deads2k's comment you have no choice but to convert those resources to openshift RBAC.

[debianmaster]

:( is there a plan to change this to match w/ k8s ?

Trying to understand more. is k8s RBAC not same as Openshift RBAC ?

[enj]

@debianmaster

:( is there a plan to change this to match w/ k8s ?

I think that is at least a release away.

Trying to understand more. is k8s RBAC not same as Openshift RBAC ?

There are a lot of subtle differences.