Bug 1471013 - System:authenticated group have no permission to do operation on resources in apigroup servicecatalog.k8s.io
System:authenticated group have no permission to do operation on resources in...
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer (Show other bugs)
Unspecified Unspecified
medium Severity medium
: ---
: ---
Assigned To: ewolinet
weiwei jiang
Depends On:
  Show dependency treegraph
Reported: 2017-07-14 05:21 EDT by weiwei jiang
Modified: 2017-08-16 15 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2017-08-10 01:31:01 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description weiwei jiang 2017-07-14 05:21:48 EDT
Description of problem:
After login to openshift catalog console  with normal user, oc get instances(bindings...) will got error "Error from server (Forbidden): User "wjiang" cannot list instances.servicecatalog.k8s.io in project "wjiang""

Version-Release number of selected component (if applicable):
# openshift version 
openshift v3.6.143
kubernetes v1.6.1+5115d708d7
etcd 3.2.1

How reproducible:

Steps to Reproduce:
1. setup openshift with servicecatalog and enable catalog console
2. login to openshift with normal user
3. try to create, list, get and delete resources of servicecatalog.k8s.io apigroup

Actual results:
Error from server (Forbidden): User "wjiang" cannot list instances.servicecatalog.k8s.io in project "wjiang"

Expected results:
System:authenticated group can not get "Forbidden"

Additional info:

Currentlly system:authenticated only have view permission on resource "serviceinnstance"
Comment 1 DeShuai Ma 2017-07-14 12:28:04 EDT
After installer service-catalog with openshift-ansible then get instance as normal user met 403 Forbidden.
Comment 4 weiwei jiang 2017-07-18 03:14:19 EDT
Checked with 
# openshift version 
openshift v3.6.151
kubernetes v1.6.1+5115d708d7
etcd 3.2.1

and project admin can create&delete&get&list&update&watch bindings and instances.
Comment 6 errata-xmlrpc 2017-08-10 01:31:01 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.