Validate if Content Library, vSphere tagging, Sessions are required in vsphere user role
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 328
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 9
Description
Content library, tagging and sessions permission that are already set in global roles might not be needed in user permission. But without them set in user permission, EKS-A fails preflight validation with
```bash
{"L":"V3","T":"2023-11-12T01:26:10.560-0600","M":"user xyz@vsphere.local missing vSphere permissions","Permissions":"- username: xyz@vsphere.local\n objectType: Network\n path: /***/network/WLR/dv-***\n permissions:\n - ContentLibrary.AddLibraryItem\n - ContentLibrary.CheckInTemplate\n - ContentLibrary.CheckOutTemplate\n - ContentLibrary.CreateLocalLibrary\n - InventoryService.Tagging.AttachTag\n - InventoryService.Tagging.CreateCategory\n - InventoryService.Tagging.CreateTag\n - InventoryService.Tagging.DeleteCategory\n - InventoryService.Tagging.DeleteTag\n - InventoryService.Tagging.EditCategory\n - InventoryService.Tagging.EditTag\n - InventoryService.Tagging.ModifyUsedByForCategory\n - InventoryService.Tagging.ModifyUsedByForTag\n - InventoryService.Tagging.ObjectAttachable\n - StorageProfile.View\n- username: xyz@vsphere.local\n objectType: Datastore\n path: /***/datastore/WLR/pure/***\n permissions:\n - ContentLibrary.AddLibraryItem\n - ContentLibrary.CheckInTemplate\n - ContentLibrary.CheckOutTemplate\n - ContentLibrary.CreateLocalLibrary\n - InventoryService.Tagging.AttachTag\n - InventoryService.Tagging.CreateCategory\n - InventoryService.Tagging.CreateTag\n - InventoryService.Tagging.DeleteCategory\n - InventoryService.Tagging.DeleteTag\n - InventoryService.Tagging.EditCategory\n - InventoryService.Tagging.EditTag\n - InventoryService.Tagging.ModifyUsedByForCategory\n - InventoryService.Tagging.ModifyUsedByForTag\n - InventoryService.Tagging.ObjectAttachable\n - StorageProfile.View\n- username: xyz@vsphere.local\n objectType: ResourcePool\n path: /***/host/DC1-EKSA-PreProd/Resources/Management\n permissions:\n - ContentLibrary.AddLibraryItem\n - ContentLibrary.CheckInTemplate\n - ContentLibrary.CheckOutTemplate\n - ContentLibrary.CreateLocalLibrary\n - InventoryService.Tagging.AttachTag\n - InventoryService.Tagging.CreateCategory\n - InventoryService.Tagging.CreateTag\n - InventoryService.Tagging.DeleteCategory\n - InventoryService.Tagging.DeleteTag\n - InventoryService.Tagging.EditCategory\n - InventoryService.Tagging.EditTag\n - InventoryService.Tagging.ModifyUsedByForCategory\n - InventoryService.Tagging.ModifyUsedByForTag\n - InventoryService.Tagging.ObjectAttachable\n - StorageProfile.View\n"}
{"L":"V0","T":"2023-11-12T01:26:10.560-0600","M":"❌ Validation failed"
```
Contributor guide
Research direction
Start with the EKS-A preflight validation that reports missing vSphere permissions, using the failure output in this issue as the reproduction case. Compare the Content Library, tagging, and session permissions assigned through global and user roles; done means the validation correctly handles permissions inherited from global roles and no longer fails for permissions that do not need to be duplicated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- authorization, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100