Bug 1893410 - [BUG] Roles\Permissions mentioned for a non-admin user is not enough to perform system deployment from satellite 6 [NEEDINFO]
Summary: [BUG] Roles\Permissions mentioned for a non-admin user is not enough to perfo...
Keywords:
Status: MODIFIED
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Provisioning
Version: 6.7.0
Hardware: All
OS: All
low
medium
Target Milestone: Unspecified
Assignee: Aneta Šteflová Petrová
QA Contact: Satellite QE Team
URL:
Whiteboard: provisioning-guide
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-10-31 05:24 UTC by Sayan Das
Modified: 2023-07-25 12:26 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:
Embargoed:
mdolezel: needinfo? (zuansorg)


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker SAT-15419 0 None None None 2023-07-07 08:29:44 UTC
Red Hat Issue Tracker SATDOC-692 0 None None None 2022-03-16 00:37:56 UTC
Red Hat Knowledge Base (Solution) 3412331 0 None None None 2020-10-31 05:24:02 UTC

Description Sayan Das 2020-10-31 05:24:02 UTC
Document URL: 

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.7/html-single/provisioning_guide/index#provisioning-virtual-machines-kvm

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.7/html-single/provisioning_guide/index#provisioning-virtual-machines-kubevirt

Section Number and Name: 

Chapter 9 and Chapter 12 - Prerequisites

"A Satellite user account with the following roles"
"A custom role in Satellite with the following permissions:"


Describe the issue: 

The permissions mentioned in these two sections are not enough. e.g. if someone wants to use hostgroup or select domain, then won't be able to do so and many more.

Suggestions for improvement: 

Rather than having two sections like that, have an entirely different section to cover the content of https://access.redhat.com/solutions/3412331 .

It's applicable for Satellite 6.6 , 6.7 , 6.8.


Additional information: 

NA

Comment 5 Aneta Šteflová Petrová 2023-07-17 09:05:08 UTC
PR submitted for review: https://github.com/theforeman/foreman-documentation/pull/2292

Comment 6 Aneta Šteflová Petrová 2023-07-20 07:43:38 UTC
(In reply to Sayan Das from comment #0)
> Rather than having two sections like that, have an entirely different
> section to cover the content of https://access.redhat.com/solutions/3412331 .
The article hasn't been updated in years. The table of permissions in that article includes permissions related to Katello which has been deprecated. Are you still using it as a reference to customers instead of the official documentation?

Comment 7 Sayan Das 2023-07-20 08:46:44 UTC
Hello, 

Yes and that is simply because the permissions suggested in the docs are not adequate enough. 

Take an example of "Chapter 9. Provisioning Virtual Machines on KVM (libvirt)" from https://access.redhat.com/documentation/en-us/red_hat_satellite/6.13/html-single/provisioning_hosts/index#Provisioning_Virtual_Machines_on_KVM_provisioning 

We say this:

** A Satellite user account with the following roles:

Edit hosts
View hosts

For more information, see Assigning Roles to a User in Administering Red Hat Satellite.

** A custom role in Satellite with the following permissions:

view_compute_resources
destroy_compute_resources_vms
power_compute_resources_vms
create_compute_resources_vms
view_compute_resources_vms
view_locations
view_subnets

For more information about creating roles, see Creating a Role in Administering Red Hat Satellite. For more information about adding permissions to a role, see Adding Permissions to a Role in Administering Red Hat Satellite.


Even if I combine all the permissions mentioned above in one role and assign the role to a user,  Still it will be impossible to deploy a host by impersonating that user. 


Our doc ( or the sections I had pointed out ) contains compute resource-specific permissions. 

In my opinion, We should have a generic section created where it would only be documented that, what all basic permissions required in a custom role, to create a host entry and submit it for build with all applicable options selected. 

And that Section should be referred to "Compute Resource" specific chapters in addition to what existing stuff we have there.

Comment 8 Aneta Šteflová Petrová 2023-07-25 10:06:28 UTC
Thanks for confirming, Sayan. I have a work-in-progress version of a table I'd like to add to the guide: https://theforeman-foreman-documentation-preview-pr-2292.surge.sh/nightly/Provisioning_Hosts/index-satellite.html#permissions-required-for-provisioning_kvm-provisioning
Is this what you'd like to see in the documentation?

I'd like to make sure the update meets your expectations before taking it to Engineering for a review.

Comment 9 Sayan Das 2023-07-25 10:26:31 UTC
While the table looks great, I believe that table would be applicable for any type of deployment ( involving compute resources) but not just for KVM or Kubevirt\Openshift virtualization. 

So that table can live somewhere at a generic location in the same doc. And it can be referred to individual sections ( wherever needed )

We can even add some comments like, Users can skip the permissions related to "Compute resource" if only Bare-Metal system builds are expected to be done i.e. without using computer resources.

Comment 10 Aneta Šteflová Petrová 2023-07-25 12:26:40 UTC
I can make the table appear at multiple places with variations based on the use case (KVM, Kubevirt, bare metal, etc.). The real challenge will be figuring out the permissions applicable to different use cases.

I will now keep working on getting the complete list of permissions.


Note You need to log in before you can comment on or make changes to this bug.