Description of problem: virtctl restart doesn't work because of wrongly configured RBAC
A fix is on it's way, see https://github.com/kubevirt/kubevirt/pull/1942
How to reproduce on OpenShift: 1. Create a user with edit role: $ oc create user foo $ oc adm policy add-cluster-role-to-user edit foo 2. Login with that user and create and start any VM: $ oc login -u foo -p ... $ oc apply -f ./cluster/examples/vm-cirros.yaml $ ./virtctl start vm-cirros 3. Try to restart that VM $ ./virtctl restart vm-cirros Error restarting VirtualMachine virtualmachines.subresources.kubevirt.io "vm-cirros" is forbidden: User "foo" cannot update virtualmachines.subresources.kubevirt.io/restart in the namespace "default": no RBAC policy matched Expected: $ ./virtctl restart vm-cirros VM vm-cirros was scheduled to restart
@Zhe, Please add test case for this scenario
Done
To reproduce/verify this, follow the steps Marc outlined.
Version: CNV 1.4 Steps form: https://bugzilla.redhat.com/show_bug.cgi?id=1666704#c2 manage to start VM with other user via virtctl.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2019:0418