Crc: [BUG] "developer" user can't see operators on web console but can list them just fine on CLI

[dharmit]

General information

• OS: Linux
• Hypervisor: KVM
• Did you run crc setup before starting it (Yes/No)? Yes

CRC version

# Put `crc version` output here
crc version: 1.6.0+8ef676f
OpenShift version: 4.3.0 (embedded in binary)

Host Operating System

# Put the output of `cat /etc/os-release` in case of Linux
$ cat /etc/os-release 
NAME=Fedora
VERSION="31 (Thirty One)"
ID=fedora
VERSION_ID=31
VERSION_CODENAME=""
PLATFORM_ID="platform:f31"
PRETTY_NAME="Fedora 31 (Thirty One)"
ANSI_COLOR="0;34"
LOGO=fedora-logo-icon
CPE_NAME="cpe:/o:fedoraproject:fedora:31"
HOME_URL="https://fedoraproject.org/"
DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora/f31/system-administrators-guide/"
SUPPORT_URL="https://fedoraproject.org/wiki/Communicating_and_getting_help"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_BUGZILLA_PRODUCT="Fedora"
REDHAT_BUGZILLA_PRODUCT_VERSION=31
REDHAT_SUPPORT_PRODUCT="Fedora"
REDHAT_SUPPORT_PRODUCT_VERSION=31
PRIVACY_POLICY_URL="https://fedoraproject.org/wiki/Legal:PrivacyPolicy"

Steps to reproduce

1. Create a project using developer user oc new-project myproject
2. Install any operator from OperatorHub by logging into the web console as kubeadmin user
3. Log into webconsole as developer user and try to list operators by going to "Installed Operators"

Expected

developer user should be able to list the installed operators

Actual

developer user is unable to see the installed operators

[anjannath]

There's a similar BZ for OLM https://bugzilla.redhat.com/show_bug.cgi?id=1625996
We can fix this in snc, need to add edit cluster role to developer user.

$ oc adm policy add-cluster-role-to-user edit developer --as system:admin                                                                                                                                 
clusterrole.rbac.authorization.k8s.io/edit added: "developer"

[cfergeau]

I'm missing the "can list them just fine on CLI" part from the initial description? Which command did you use on the command line to list the operators as a developer?

[dharmit]

I'm missing the "can list them just fine on CLI" part from the initial description? Which command did you use on the command line to list the operators as a developer?

oc get csv / oc get csvs

[cfergeau]

For what it's worth, I'm not able to reproduce

$ oc login -u developer -p developer https://api.crc.testing:6443
$ oc get csv -A
Error from server (Forbidden): clusterserviceversions.operators.coreos.com is forbidden: User "developer" cannot list resource "clusterserviceversions" in API group "operators.coreos.com" at the cluster scope

On my test instance, the developer user cannot list operators from the commandline (and neither can they from the web console)

[dharmit]

You're facing the error because you're trying to list operators from all namespaces. It's expected to not work if developer user tries to list operators for all namesapces.

$ oc whoami    
developer

$ oc get csv
NAME                     DISPLAY   VERSION   REPLACES                 PHASE
3scale-operator.v0.4.2   3scale    0.4.1     3scale-operator.v0.4.1   Installing

$ oc get csv -A
Error from server (Forbidden): clusterserviceversions.operators.coreos.com is forbidden: User "developer" cannot list resource "clusterserviceversions" in API group "operators.coreos.com" at the cluster scope

[anjannath]

I tried the same, and found that its able to list them on cli if a project is active, with no projects selected it tries to show the csvs from the default project and throws the error.

$ oc project
Using project "test" on server "https://api.crc.testing:6443".

$ oc get subs
No resources found in test namespace.

# After installing an operator as kubeadmin
$ oc get csv
NAME               DISPLAY     VERSION   REPLACES   PHASE
kubestone.v0.4.0   Kubestone   0.4.0                Succeeded

[cfergeau]

Thanks @anjannath, I can indeed reproduce with these additional steps!
In my opinion, this is a bug in the web UI as it correctly shows that it's listing the operators in the project project, but then displays a permission error. oc get csv works fine, so it probably should be able to show us "something". I'd rather file this against the web console first, and revisit it if we get an explanation that this is not a bug on their side.

[gorkem]

@cfergeau Did you file this on the OS Console too? Can you put a reference to it.

As a reference this is also affecting odo catalog list services command as it has started to list installed operators

[cfergeau]

@cfergeau Did you file this on the OS Console too? Can you put a reference to it.

I did not file anything yet, I was waiting to see if you agree with my analysis.

[gorkem]

@cfergeau correct, Console has a misleading behavior that when the user does not belong to any projects, project selector defaults to project "default" and shows no operators installed.

In case of crc user developer has no projects created to start with. I guess the question for crc is whether we would like to create the myproject project just like we did on minishift.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[gorkem]

This is still a valid usability issue for CRC.

[cfergeau]

If the usability issue you refer to is

I guess the question for crc is whether we would like to create the myproject project just like we did on minishift.
I don't think this is what this bug was initially about.

[gorkem]

Yes, that is the one

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.