Uploaded image for project: 'OpenShift Virtualization'
  1. OpenShift Virtualization
  2. CNV-29391

[2211841] Regular users can't use NADs located in other namespaces in their VMs despite having permissions to access them

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Blocker Blocker
    • None
    • None
    • CNV User Interface
    • None

      Description of problem:
      If a regular user has RBAC to get/list/watch a network-atttachment-definition in a namespace the user is not an admin of, the "Add network interface" modal doesn't allow the user to use that NAD in the new NIC. A red message is shown: "No NetworkAttachmentDefinitions available. Contact your system administrator for additional support.".
      We would expect that if such permission configured for a user, s/he should be able to use that NAD in their VMs reside in namespaces they're admins of.

      Version-Release number of selected component (if applicable):
      4.13.0, but probably happens in previous versions.

      How reproducible:
      100%

      Steps to Reproduce:
      1. create a NAD in some arbitrary namespace (e.g. default)
      2. add clusterrole of get, list, watch to that NAD, and rolebinding in the user's namespace for this role and a regular user.
      3. when logged-in as the user, try to create a VM in a namespace the user is an admin of, and then try to add an additional network interface using NAD/bridge.

      Actual results:
      The user is not allowed to select the NAD s/he has permissions to. The drop-down list is grayed-out.

      Expected results:
      The user should see the NAD on the "Network" drop-down list and be able to select and use it for their VM.

      Additional info:

              mschatzm@redhat.com Matan Schatzman
              ocohen@redhat.com Oren Cohen
              Leon Kladnitsky Leon Kladnitsky
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: