Bug 1455691 - [3.4] BACKPORT: User can not see .operations.* index even though he belongs to a group with cluster-admin role
Summary: [3.4] BACKPORT: User can not see .operations.* index even though he belongs t...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Logging
Version: 3.4.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 3.4.z
Assignee: Jeff Cantrill
QA Contact: Xia Zhao
URL:
Whiteboard:
Depends On: 1446217
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-05-25 20:17 UTC by Steven Walter
Modified: 2020-08-13 09:16 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: A user's role was not using the correct mechanism for evaluating what projects they could see Consequence: User's in a group were improperly being denied viewing logs for admin projects. Fix: Use SubjectAccessReview to evaluate project visibility Result: User's of a group that can see a project are able to see project logs without given explicit access to the project.
Clone Of: 1446217
Environment:
Last Closed: 2017-06-15 18:41:06 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fabric8io openshift-elasticsearch-plugin issues 72 0 None None None 2017-05-25 20:17:03 UTC
Red Hat Product Errata RHBA-2017:1425 0 normal SHIPPED_LIVE OpenShift Container Platform 3.5, 3.4, 3.3, and 3.2 bug fix update 2017-06-15 22:35:53 UTC

Comment 1 Steven Walter 2017-05-25 20:18:17 UTC 
This is a backport request for 3.4 for https://bugzilla.redhat.com/show_bug.cgi?id=1446217
Comment 3 Jeff Cantrill 2017-05-30 21:04:48 UTC 
Changes made in:

https://github.com/fabric8io/openshift-elasticsearch-plugin/pull/80
https://github.com/openshift/origin-aggregated-logging/pull/446

Will need to be merged downstream.
Comment 6 Xia Zhao 2017-06-05 09:53:31 UTC 
It's fixed, verified with users belongs to a group with cluster-admin role, she's now able to see log entries inside index ".operations*" after logged in to kibana:

-------------------------
Test env:
# openshift version
openshift v3.4.1.32
kubernetes v1.4.0+776c994
etcd 3.1.0-rc.0

Image tested with:
openshift3/logging-elasticsearch      3.4.1               0b64a8a567d5

--------------------------
Test steps:
# oadm groups new testing
NAME      USERS
testing   
# oadm groups add-users testing xiazhao
# oadm policy add-role-to-group cluster-admin testing

Then logged in to kibana UI with user xiazhao, she's able to see log entries inside index ".operations*"
Comment 8 errata-xmlrpc 2017-06-15 18:41:06 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1425
Note You need to log in before you can comment on or make changes to this bug.