Bug 1727266
| Summary: | Storage-admin can get but not describe pvc from other's project | |||
|---|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Liang Xia <lxia> | |
| Component: | Storage | Assignee: | Christian Huffman <chuffman> | |
| Status: | CLOSED ERRATA | QA Contact: | Liang Xia <lxia> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 4.2.0 | CC: | aos-bugs, aos-storage-staff, bchilds, hekumar | |
| Target Milestone: | --- | |||
| Target Release: | 4.2.0 | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1741039 (view as bug list) | Environment: | ||
| Last Closed: | 2019-10-16 06:33:09 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1741039 | |||
I submitted a PR [1] to the openshift-apiserver repo to address this issue. This PR adds the get, list, and watch verbs for pod resources to the `storage-admin` role. [1] https://github.com/openshift/openshift-apiserver/pull/10 Verified with 4.2.0-0.nightly-2019-08-13-183722 that storage-admin can describe pvc. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2922 |
Description of problem: A user with storage-admin privilege can get pvc from other's project, but failed to describe the pvc with below error: Error from server (Forbidden): pods is forbidden: User "testuser-24" cannot list resource "pods" in API group "" in the namespace "3dv-k" Version-Release number of selected component (if applicable): 4.2.0-0.nightly-2019-06-30-221852 Client Version: version.Info{Major:"4", Minor:"2+", GitVersion:"v4.2.0", GitCommit:"96d312193", GitTreeState:"clean", BuildDate:"2019-07-04T06:28:12Z", GoVersion:"go1.12.6", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.Info{Major:"1", Minor:"14+", GitVersion:"v1.14.0+5ca1653", GitCommit:"5ca1653", GitTreeState:"clean", BuildDate:"2019-06-29T04:02:24Z", GoVersion:"go1.12.6", Compiler:"gc", Platform:"linux/amd64"} How reproducible: Always Steps to Reproduce: 1.Login as end user, and create a pvc. 2.Login as another user with storage-admin privilege, check above pvc. Actual results: Storage-admin user can get the pvc, but failed to describe the pvc with below error: Error from server (Forbidden): pods is forbidden: User "testuser-24" cannot list resource "pods" in API group "" in the namespace "3dv-k" Expected results: Storage-admin can also describe the pvc from other's project. Additional info: