-
Bug
-
Resolution: Unresolved
-
Critical
-
ACM 2.14.0, ACM 2.15.0
Description of problem:
When fine grained RBAC is enabled, search bypasses check for create managedclusterview permissions. This breaks UI Policy and Application pages and only allows users with cluster-admin ClusterRoleBinding on the hub to see non-kubevirt resources in search.
Version-Release number of selected component (if applicable): 2.14, 2.15
How reproducible: always
Steps to Reproduce:
- Enable fine grained rbac TP feature
- kubectl create clusterrolebinding view_qe-admin-user --clusterrole=view --user=qe-admin-user
- kubectl auth can-i create managedclusterview -A (should return yes - view ClusterRole includes create managedclusterview permissions)
Actual results:
Check ACM Search UI as qe-admin-user; no managed cluster resources are shown
Expected results:
Managed cluster resources should be shown because user has create managedclusterview permissions
Additional info:
- blocks
-
ACM-21065 Fine-grained RBAC for Virtualization GA in Search (2.16)
-
- New
-