aws / aws/eks-anywhere

Global Admin role missing ContentLibrary.DeleteLibraryItem permission

Open
#4,214 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2.1k
Forks
328
Avg merge
1d 4h
Merged PRs (30d)
9

Description

**What happened**: The Global Admin customer role advised to be created from the EKS-A [documentation](https://anywhere.eks.amazonaws.com/docs/reference/vsphere/vsphere-preparation/#create-and-define-user-roles) is missing the `ContentLibrary.DeleteLibraryItem` permission in the scenario the library item is corrupted or failed to upload when first running `eksctl anywhere create cluster`. It looks related to this code - https://github.com/aws/eks-anywhere/blob/116265ad3ba450e455cbad914b0d16681a17f813/pkg/providers/vsphere/internal/templates/factory.go#L128.

**What you expected to happen**: eksctl create cluster command to run a 2nd time, without having to delete content library manually due to 403 forbidden error.

**How to reproduce it (as minimally and precisely as possible)**:
Difficult to re-produce.

**Environment**:
- EKS Anywhere Release: 0.12.1

Contributor guide

Open the contributing guide

Research direction

Start in pkg/providers/vsphere/internal/templates/factory.go around line 128 and compare the generated Global Admin role with the EKS-A vSphere preparation documentation. Confirm that ContentLibrary.DeleteLibraryItem is included, then verify that a second eksctl anywhere create cluster attempt can remove a failed or corrupted library item without a 403 error.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
infrastructure
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.