-
Bug
-
Resolution: Won't Do
-
Blocker
-
None
-
None
-
Quality / Stability / Reliability
-
False
-
-
False
-
NEW
-
-
-
None
Description of problem:
If a regular user has RBAC to get/list/watch a network-atttachment-definition in a namespace the user is not an admin of, the "Add network interface" modal doesn't allow the user to use that NAD in the new NIC. A red message is shown: "No NetworkAttachmentDefinitions available. Contact your system administrator for additional support.".
We would expect that if such permission configured for a user, s/he should be able to use that NAD in their VMs reside in namespaces they're admins of.
Version-Release number of selected component (if applicable):
4.13.0, but probably happens in previous versions.
How reproducible:
100%
Steps to Reproduce:
1. create a NAD in some arbitrary namespace (e.g. default)
2. add clusterrole of get, list, watch to that NAD, and rolebinding in the user's namespace for this role and a regular user.
3. when logged-in as the user, try to create a VM in a namespace the user is an admin of, and then try to add an additional network interface using NAD/bridge.
Actual results:
The user is not allowed to select the NAD s/he has permissions to. The drop-down list is grayed-out.
Expected results:
The user should see the NAD on the "Network" drop-down list and be able to select and use it for their VM.
Additional info:
- links to
- mentioned on