Skip to content

Document changes in reconcile commands #5725

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 20, 2017
Merged

Document changes in reconcile commands #5725

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 20 additions & 2 deletions architecture/additional_concepts/authorization.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -273,14 +273,32 @@ ifdef::openshift-enterprise,openshift-origin[]
=== Updating Cluster Roles

After any xref:../../install_config/upgrading/index.adoc#install-config-upgrading-index[{product-title} cluster
upgrade], the recommended default roles may have been updated. See
upgrade], the default roles are updated and automatically reconciled when the
server is started. Additionally, see
xref:../../install_config/upgrading/manual_upgrades.adoc#updating-policy-definitions[Updating
Policy Definitions] for instructions on getting to the new recommendations
Policy Definitions] for instructions on getting other recommendations
using:

----
$ oc adm policy reconcile-cluster-roles
----

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need to add a section ID before the section heading:

[[applying-custom-roles-and-permissions]]

[[applying-custom-roles-and-permissions]]

=== Applying Custom Roles and Permissions

To add or update custom roles and permissions, it is strongly recommended to use
the following command:

----
# oc auth reconcile -f FILE
----

This command ensures that new permissions are applied properly in a way that
will not break other clients. This is done internally by computing logical
covers operations between rule sets, which is something you cannot do via a
JSON merge on policy files.

endif::[]
ifdef::openshift-origin,openshift-enterprise,openshift-dedicated[]

Expand Down
12 changes: 7 additions & 5 deletions install_config/upgrading/manual_upgrades.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -423,10 +423,10 @@ updated.
[[updating-policy-definitions]]
== Updating Policy Definitions

After a cluster upgrade, the recommended
After a cluster upgrade, the default roles
xref:../../architecture/additional_concepts/authorization.adoc#roles[default
cluster roles] may be updated. To check if an update is recommended for
your environment, you can run:
cluster roles] are automatically updated. To check if all defaults are set as
recommended for your environment, run:

----
# oadm policy reconcile-cluster-roles
Expand All @@ -436,8 +436,10 @@ your environment, you can run:
====
If you have customized default cluster roles and want to ensure a role reconciliation
does not modify those customized roles, annotate them with `openshift.io/reconcile-protect`
set to `true`. Doing so means you are responsible for manually updating those roles with
any new or required permissions during upgrades.
set to `true` when using the old Openshift policy format. When using the new RBAC
roles, use `rbac.authorization.kubernetes.io/autoupdate` set to `false` instead.
In doing so, you are responsible for manually updating those roles with any new
or required permissions during upgrades.
====

This command outputs a list of roles that are out of date and their new proposed
Expand Down