Bug 1471013

Summary:	System:authenticated group have no permission to do operation on resources in apigroup servicecatalog.k8s.io
Product:	OpenShift Container Platform	Reporter:	weiwei jiang <wjiang>
Component:	Installer	Assignee:	ewolinet
Status:	CLOSED ERRATA	QA Contact:	weiwei jiang <wjiang>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	3.6.0	CC:	aos-bugs, dma, jokerman, jpeeler, mmccomas
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-10 05:31:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description weiwei jiang 2017-07-14 09:21:48 UTC

Description of problem:
After login to openshift catalog console  with normal user, oc get instances(bindings...) will got error "Error from server (Forbidden): User "wjiang" cannot list instances.servicecatalog.k8s.io in project "wjiang""

Version-Release number of selected component (if applicable):
# openshift version 
openshift v3.6.143
kubernetes v1.6.1+5115d708d7
etcd 3.2.1


How reproducible:
always

Steps to Reproduce:
1. setup openshift with servicecatalog and enable catalog console
2. login to openshift with normal user
3. try to create, list, get and delete resources of servicecatalog.k8s.io apigroup

Actual results:
Error from server (Forbidden): User "wjiang" cannot list instances.servicecatalog.k8s.io in project "wjiang"

Expected results:
System:authenticated group can not get "Forbidden"

Additional info:

Currentlly system:authenticated only have view permission on resource "serviceinnstance"

Comment 1 DeShuai Ma 2017-07-14 16:28:04 UTC

After installer service-catalog with openshift-ansible then get instance as normal user met 403 Forbidden.

Comment 2 Scott Dodson 2017-07-14 20:02:53 UTC

https://github.com/openshift/openshift-ansible/pull/4765

Comment 4 weiwei jiang 2017-07-18 07:14:19 UTC

Checked with 
# openshift version 
openshift v3.6.151
kubernetes v1.6.1+5115d708d7
etcd 3.2.1

and project admin can create&delete&get&list&update&watch bindings and instances.

Comment 6 errata-xmlrpc 2017-08-10 05:31:01 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1716