Uploaded image for project: 'Red Hat Advanced Cluster Management'
  1. Red Hat Advanced Cluster Management
  2. ACM-26087

Search - Fine grained RBAC not working with managedclusterview permissions

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • False
    • Critical
    • None

      Description of problem:

      When fine grained RBAC is enabled, search bypasses check for create managedclusterview permissions. This breaks UI Policy and Application pages and only allows users with cluster-admin ClusterRoleBinding on the hub to see non-kubevirt resources in search.

      Version-Release number of selected component (if applicable): 2.14, 2.15

      How reproducible: always

      Steps to Reproduce:

      1. Enable fine grained rbac TP feature
      2. kubectl create clusterrolebinding view_qe-admin-user --clusterrole=view --user=qe-admin-user
      3. kubectl auth can-i create managedclusterview -A (should return yes - view ClusterRole includes create managedclusterview permissions)

      Actual results:

      Check ACM Search UI as qe-admin-user; no managed cluster resources are shown

      Expected results:

      Managed cluster resources should be shown because user has create managedclusterview permissions

      Additional info:

              jpadilla@redhat.com Jorge Padilla
              rh-ee-mshort Matthew Short
              Atif Shafi Atif Shafi
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated: