aws / aws/eks-anywhere

Validate if Content Library, vSphere tagging, Sessions are required in vsphere user role

Open
#7,062 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2.1k
Forks
328
Avg merge
1d 4h
Merged PRs (30d)
9

Description

Content library, tagging and sessions permission that are already set in global roles might not be needed in user permission. But without them set in user permission, EKS-A fails preflight validation with

```bash
{"L":"V3","T":"2023-11-12T01:26:10.560-0600","M":"user xyz@vsphere.local missing vSphere permissions","Permissions":"- username: xyz@vsphere.local\n objectType: Network\n path: /***/network/WLR/dv-***\n permissions:\n - ContentLibrary.AddLibraryItem\n - ContentLibrary.CheckInTemplate\n - ContentLibrary.CheckOutTemplate\n - ContentLibrary.CreateLocalLibrary\n - InventoryService.Tagging.AttachTag\n - InventoryService.Tagging.CreateCategory\n - InventoryService.Tagging.CreateTag\n - InventoryService.Tagging.DeleteCategory\n - InventoryService.Tagging.DeleteTag\n - InventoryService.Tagging.EditCategory\n - InventoryService.Tagging.EditTag\n - InventoryService.Tagging.ModifyUsedByForCategory\n - InventoryService.Tagging.ModifyUsedByForTag\n - InventoryService.Tagging.ObjectAttachable\n - StorageProfile.View\n- username: xyz@vsphere.local\n objectType: Datastore\n path: /***/datastore/WLR/pure/***\n permissions:\n - ContentLibrary.AddLibraryItem\n - ContentLibrary.CheckInTemplate\n - ContentLibrary.CheckOutTemplate\n - ContentLibrary.CreateLocalLibrary\n - InventoryService.Tagging.AttachTag\n - InventoryService.Tagging.CreateCategory\n - InventoryService.Tagging.CreateTag\n - InventoryService.Tagging.DeleteCategory\n - InventoryService.Tagging.DeleteTag\n - InventoryService.Tagging.EditCategory\n - InventoryService.Tagging.EditTag\n - InventoryService.Tagging.ModifyUsedByForCategory\n - InventoryService.Tagging.ModifyUsedByForTag\n - InventoryService.Tagging.ObjectAttachable\n - StorageProfile.View\n- username: xyz@vsphere.local\n objectType: ResourcePool\n path: /***/host/DC1-EKSA-PreProd/Resources/Management\n permissions:\n - ContentLibrary.AddLibraryItem\n - ContentLibrary.CheckInTemplate\n - ContentLibrary.CheckOutTemplate\n - ContentLibrary.CreateLocalLibrary\n - InventoryService.Tagging.AttachTag\n - InventoryService.Tagging.CreateCategory\n - InventoryService.Tagging.CreateTag\n - InventoryService.Tagging.DeleteCategory\n - InventoryService.Tagging.DeleteTag\n - InventoryService.Tagging.EditCategory\n - InventoryService.Tagging.EditTag\n - InventoryService.Tagging.ModifyUsedByForCategory\n - InventoryService.Tagging.ModifyUsedByForTag\n - InventoryService.Tagging.ObjectAttachable\n - StorageProfile.View\n"}
{"L":"V0","T":"2023-11-12T01:26:10.560-0600","M":"❌ Validation failed"
```

Contributor guide

Open the contributing guide

Research direction

Start with the EKS-A preflight validation that reports missing vSphere permissions, using the failure output in this issue as the reproduction case. Compare the Content Library, tagging, and session permissions assigned through global and user roles; done means the validation correctly handles permissions inherited from global roles and no longer fails for permissions that do not need to be duplicated.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
authorization, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.