Bug 1455691 – [3.4] BACKPORT: User can not see .operations.* index even though he belongs to a group with cluster-admin role

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1455691 - [3.4] BACKPORT: User can not see .operations.* index even though he belongs to a group with cluster-admin role

Summary:	[3.4] BACKPORT: User can not see .operations.* index even though he belongs t...

Status:	CLOSED ERRATA

Aliases:	None

Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Logging (Show other bugs)
Sub Component:
Version:	3.4.0
Hardware:	Unspecified Unspecified

Priority	high Severity high
Target Milestone:	---
Target Release:	3.4.z
Assigned To:	Jeff Cantrill
QA Contact:	Xia Zhao
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:	1446217
Blocks:
	Show dependency tree / graph

Reported:	2017-05-25 16:17 EDT by Steven Walter
Modified:	2018-07-19 02:10 EDT (History)
CC List:	13 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	Cause: A user's role was not using the correct mechanism for evaluating what projects they could see Consequence: User's in a group were improperly being denied viewing logs for admin projects. Fix: Use SubjectAccessReview to evaluate project visibility Result: User's of a group that can see a project are able to see project logs without given explicit access to the project.
Story Points:	---
Clone Of:	1446217
Environment:
Last Closed:	2017-06-15 14:41:06 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Github	fabric8io/openshift-elasticsearch-plugin/issues/72	None	None	None	2017-05-25 16:17 EDT
Red Hat Product Errata	RHBA-2017:1425	normal	SHIPPED_LIVE	OpenShift Container Platform 3.5, 3.4, 3.3, and 3.2 bug fix update	2017-06-15 18:35:53 EDT

Groups: None (edit)

Comment 1 Steven Walter 2017-05-25 16:18:17 EDT

This is a backport request for 3.4 for https://bugzilla.redhat.com/show_bug.cgi?id=1446217

Comment 3 Jeff Cantrill 2017-05-30 17:04:48 EDT

Changes made in:

https://github.com/fabric8io/openshift-elasticsearch-plugin/pull/80
https://github.com/openshift/origin-aggregated-logging/pull/446

Will need to be merged downstream.

Comment 6 Xia Zhao 2017-06-05 05:53:31 EDT

It's fixed, verified with users belongs to a group with cluster-admin role, she's now able to see log entries inside index ".operations*" after logged in to kibana:

-------------------------
Test env:
# openshift version
openshift v3.4.1.32
kubernetes v1.4.0+776c994
etcd 3.1.0-rc.0

Image tested with:
openshift3/logging-elasticsearch      3.4.1               0b64a8a567d5

--------------------------
Test steps:
# oadm groups new testing
NAME      USERS
testing   
# oadm groups add-users testing xiazhao
# oadm policy add-role-to-group cluster-admin testing

Then logged in to kibana UI with user xiazhao, she's able to see log entries inside index ".operations*"

Comment 8 errata-xmlrpc 2017-06-15 14:41:06 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1425

Note You need to log in before you can comment on or make changes to this bug.