-
Feature Request
-
Resolution: Done
-
Major
-
None
-
None
-
Product / Portfolio Work
-
None
-
False
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
Prerequisites (if any, like setup, operators/versions):
login to console with 2 separate users with access to the same namespace
With admin user ensure that each user has the ability to export an app:
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: primer-export
rules:
- verbs:
- create
- delete
- get
- list
apiGroups:
- primer.gitops.io
resources:
- exports
eg Role binding for the `consoledeveloper`
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: consoledeveloper-export-primer
subjects:
- kind: User
apiGroup: rbac.authorization.k8s.io
name: consoledeveloper
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: primer-export
Steps to Reproduce
- create a namespace
- create an application (eg deploy openshift/hello-openshift
- go to topology
- with user1 export the application
- with user2 go to the same namespace and attempt to export the application
- Observe
user2 cannot export because an export is already in progress
user2's export may differ from user1 due to differences in rbac - wait for user1's export to complete and the toast to appear, do not close the toast
- with user2 start an export
- with user1 try to download
- Observe
download fails because starting user2's export results in the deletion of user1's export
Reproducibility (Always/Intermittent/Only Once):
always
Build Details:
4.9.0-0.nightly-2021-08-23-224104