Bug 1446217

Description of problem:
User is not able to see .logging.* even when he belongs to a group that has been granted with cluster-admin role 

Version-Release number of selected component (if applicable):
3.4

How reproducible:
100%

Steps to Reproduce:

- Make sure user belongs (or its group) to the 

# oc describe clusterPolicyBindings :default | egrep 'RoleBinding\[cluster-admins\]' -A

RoleBinding[cluster-admins]:
                                                                Role:                   cluster-admin
                                                                Users:                  system:admin
                                                                Groups:                 system:cluster-admins, group-admins
                                                                ServiceAccounts:        <none>
                                                                Subjects:               <none>


# oc get groups
NAME                          USERS
group-admins                     user1, user2, user3
group-users



- Check, logged as user1, check if you can see entries in .operatoins.* entry logs

# curl --key /etc/elasticsearch/secret/admin-key --cert  /etc/elasticsearch/secret/admin-cert --cacert  /etc/elasticsearch/secret/admin-ca https://localhost:9200/.operations.*/_search | python -mjson.tool | more

{
    "_shards": {
        "failed": 0,
        "successful": 7,
        "total": 7
    },
    "hits": {
        "hits": [
           
	****** LOG ENTRIES *******

        ],
        "max_score": 1.0,
        "total": 76368185
    },
    "timed_out": false,
    "took": 60
}


- Search for an string:

# oc exec logging-kibana-ops-1-ew340  -c kibana -- curl --connect-timeout 1 -s -k        --cert /etc/kibana/keys/cert --key /etc/kibana/keys/key        -H "X-Proxy-Remote-User: $test_name" -H "Authorization: Bearer $test_token" -H "X-Forwarded-For: 127.0.0.1"        https://logging-es-ops:9200/.operations.*/_search\?q=message:"for"

{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for indices:data/read/search"}],"type":"security_exception","reason":"no permissions for indices:data/read/search"},"status":403}

**** you get above permission error message


- Instead, if you set the cluster-admin role directly to the user: 
# oadm policy add-cluster-role-to-user cluster-admin user1

- Then the user will be able to search for strings in the .operations.* index:

# oc exec logging-kibana-ops-1-ew340  -c kibana -- curl --connect-timeout 1 -s -k        --cert /etc/kibana/keys/cert --key /etc/kibana/keys/key        -H "X-Proxy-Remote-User: $test_name" -H "Authorization: Bearer $test_token" -H "X-Forwarded-For: 127.0.0.1"        https://logging-es-ops:9200/.operations.*/_search\?q=message:"for"

{"took":1055,"timed_out":false,"_shards":{"total":7,"successful":7,"failed":0},"hits":{"total":3811811,"max_score":7.1148357,"hits":[******* LOG ENTRIES *******]}}


Actual results:

Permission error message is displayed

Expected results:

Output should show matchs for the string we are looking for. 

Additional info: