-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
4.18, 4.19, 4.20
-
None
-
Quality / Stability / Reliability
-
False
-
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
Under UserDefinedNetwork docs, the instructions for creating UserDefinedNetwork via CLI perquisites specify you need to be logged in with cluster-admin or have view edit RBACs. https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/multiple_networks/primary-networks This is not accurate because creating namespace require cluster-admin permissions. While instantiating the UserDefinedNetwork CR require view/edit permissions, (or clsuter-admin). Regarding to instructions via webconsole https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/multiple_networks/primary-networks#nw-udn-cr-ui_about-user-defined-networks prerequisites specify you need to have cluster-admin permissions. This is wrong because once the Namespace exists, the CR can be created by a user who has permissions for this namespace, i.e.: project admin.
Version-Release number of selected component (if applicable):
How reproducible:
Steps to Reproduce:
1. Login as project admin (non cluster-admin)
2. Follow https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/multiple_networks/primary-networks#nw-udn-cr_about-user-defined-networks
Actual results:
Failure to create Namespace.
Expected results:
Docs should say the procedure require cluster admin for creating the Namespace. And for creating the UserDefinedNetwork it can be cluster admin or project admin (who has view and edit permissions). Webconsole instruction should mention non-admin cluster users can create UserDefinedNetwork objects.
Additional info:
Docs should emphasize the fact the admin require to provision the namespace for the project-admins. And once the namespaces is ready, the project-admin can create the UserDefinedNetwork CR. Please note the user story for the UserDefiendNetwork CRD what to enable non-admin users create user-defined networks in namespaces they have permissions to, such as project admin. With zero/minimal intervention by the clsuter admin. In regard to the use case where project-admin wants to create UserDefiendNetwork, I think docs should emphasis where the cluster-admin role start and ends in the process.
- relates to
-
CNV-71776 Docs about UserDefinedNetwork objects are inacurate wont reflect non-admin users use-case for UDNs
-
- New
-