kcp-dev
To use CWT the user needs to have "access" permissions in workspaces where the CWT exists
Describe the bug
Consider that there is a CWT Foo in a workspace root:org:plane. The workspace contains also a CR & CRB granting use permissions to the system:authenticated group.
Then a user bob wants to create a workspace of the type Foo in his home workspace, but this fails:
$ k ws create bar --type root:org:plane:Foo
Error: workspaces.tenancy.kcp.dev "bar" is forbidden: use of the cluster workspace type "root:org:plane:Foo" in workspace "root:users:qa:kh:bob" is not allowed
the kcp logs contain:
E0713 14:19:32.825814 472150 rest.go:629] user "bob" lacks (denied) clusterworkspacetypes "use" permission for "foo" in root:users:qa:kh:bob: workspace access not permitted
This is because the user bob doesn't have any permission in the root:org:plane workspace. When kcp does SAR for the CWT then it expects that the user has access permissions in the workspace (and also all parent workspaces).
To Reproduce Steps to reproduce the behavior:
- Create CWT
Fooinroot:org:plane(with the necessary CR & CRB grantingusepermissions) k ws create bar --type root:org:plane:Foo
Expected behavior
it should not require access permissions in the workspace where CWT is defined.
Additional context https://coreos.slack.com/archives/C020QAF9D46/p1657716975579069
This technically applies to all SARs that are executed for any other resource - for example an APIExport
This might be helped with a generic Export mechanism, where users could export things (CWT, APIExport) into a "catalog" in the root
Issues go stale after 90d of inactivity.
After a furter 30 days, they will turn rotten.
Mark the issue as fresh with /remove-lifecycle stale.
If this issue is safe to close now please do so with /close.
/lifecycle stale
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
/lifecycle rotten
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
/close
@kcp-ci-bot: Closing this issue.
In response to this:
Rotten issues close after 30d of inactivity. Reopen the issue with
/reopen. Mark the issue as fresh with/remove-lifecycle rotten./close
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.