Description of problem: A user with storage-admin privilege can get pvc from other's project, but failed to describe the pvc with below error: Error from server (Forbidden): pods is forbidden: User "testuser-24" cannot list resource "pods" in API group "" in the namespace "3dv-k" Version-Release number of selected component (if applicable): 4.2.0-0.nightly-2019-06-30-221852 Client Version: version.Info{Major:"4", Minor:"2+", GitVersion:"v4.2.0", GitCommit:"96d312193", GitTreeState:"clean", BuildDate:"2019-07-04T06:28:12Z", GoVersion:"go1.12.6", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.Info{Major:"1", Minor:"14+", GitVersion:"v1.14.0+5ca1653", GitCommit:"5ca1653", GitTreeState:"clean", BuildDate:"2019-06-29T04:02:24Z", GoVersion:"go1.12.6", Compiler:"gc", Platform:"linux/amd64"} How reproducible: Always Steps to Reproduce: 1.Login as end user, and create a pvc. 2.Login as another user with storage-admin privilege, check above pvc. Actual results: Storage-admin user can get the pvc, but failed to describe the pvc with below error: Error from server (Forbidden): pods is forbidden: User "testuser-24" cannot list resource "pods" in API group "" in the namespace "3dv-k" Expected results: Storage-admin can also describe the pvc from other's project. Additional info:
I submitted a PR [1] to the openshift-apiserver repo to address this issue. This PR adds the get, list, and watch verbs for pod resources to the `storage-admin` role. [1] https://github.com/openshift/openshift-apiserver/pull/10
Verified with 4.2.0-0.nightly-2019-08-13-183722 that storage-admin can describe pvc.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2922