Global Admin role missing ContentLibrary.DeleteLibraryItem permission
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 328
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 9
Description
**What happened**: The Global Admin customer role advised to be created from the EKS-A [documentation](https://anywhere.eks.amazonaws.com/docs/reference/vsphere/vsphere-preparation/#create-and-define-user-roles) is missing the `ContentLibrary.DeleteLibraryItem` permission in the scenario the library item is corrupted or failed to upload when first running `eksctl anywhere create cluster`. It looks related to this code - https://github.com/aws/eks-anywhere/blob/116265ad3ba450e455cbad914b0d16681a17f813/pkg/providers/vsphere/internal/templates/factory.go#L128.
**What you expected to happen**: eksctl create cluster command to run a 2nd time, without having to delete content library manually due to 403 forbidden error.
**How to reproduce it (as minimally and precisely as possible)**:
Difficult to re-produce.
**Environment**:
- EKS Anywhere Release: 0.12.1
Contributor guide
Research direction
Start in pkg/providers/vsphere/internal/templates/factory.go around line 128 and compare the generated Global Admin role with the EKS-A vSphere preparation documentation. Confirm that ContentLibrary.DeleteLibraryItem is included, then verify that a second eksctl anywhere create cluster attempt can remove a failed or corrupted library item without a 403 error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- infrastructure
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100