What is the suggestion for security around image promotion?

[alberttwong]

Our OCP environment is one cluster with environments being separated by projects. We know that images are promoted by using the “oc tag” command. Is there any security around this? Can I tag an image into a project that I do not have access to, since it is a shared image registry?

http://v1.uncontained.io/playbooks/continuous_delivery/image_promotion.html

[sabre1041]

No. The registry obey's OpenShift RBAC

[alberttwong]

So if OCP RBAC doesn't grant you access to the container registry namespace, you won't get access to the image?

[sabre1041]

@alberttwong it is based on the namespace of where the image is stored within, not the namespace of where the registry is located.