VM actions Restart and Pause are not available for namespaced admin user in the Openshift Virtualization Console.

Solution In Progress - Updated -

Environment

  • Openshift Virtualization (CNV) version 4.20.x

Issue

  • Users bound only to the standard namespace-scoped admin ClusterRole (via RoleBinding, not ClusterRoleBinding) cannot see or use the Pause, Restart Actions in the OpenShift Console's Virtualization UI, despite having correct RBAC permissions for the underlying subresources and resources.

  • Using CLI tools such as virtctl, the VM's can be Restarted and Paused, the issue with OpenShift Console's Virtualization UI.

Resolution

  • JIRA CNV-96191 has been added with Engineering to correct this defect.

  • This problem is not observed on Openshift Virtualization (CNV) version 4.21.x version.

  • As a temporary workaround, you can add a kubevirt-plugin-ssar-workaround ClusterRole granting update on those two inverted names and bind it to the admin group with a namespace-scoped RoleBinding; since RBAC is a pure string match, this makes the SelfSubjectAccessReview pass and re-enables the buttons.
    It should be removed once the JIRA CNV-96191 is installed or the cluster is upgraded to 4.21.

cat <<EOF | oc apply -f -
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubevirt-plugin-ssar-workaround
rules:
- apiGroups: ["subresources.kubevirt.io"]
  resources:
  - virtualmachineinstances/restart
  - virtualmachines/pause
  verbs: ["update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubevirt-plugin-ssar-workaround
  namespace: dev-test-doc
subjects:
- kind: Group
  name: dev-test-doc-admins
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: kubevirt-plugin-ssar-workaround
  apiGroup: rbac.authorization.k8s.io
EOF

Root Cause

  • It appears that Restart and Pause asAccessReview checks in the kubvirt-plugin are inverted.
    The subresources.kubevirt.io/virtualmachineinstances/restart but should be virtualmachines/restart and subresources.kubevirt.io/virtualmachines/pause should be virtualmachineinstances/pause.
File: src/views/virtualmachines/actions/VirtualMachineActionFactory.tsx

https://github.com/kubevirt-ui/kubevirt-plugin/blob/f8bde8849/src/views/virtualmachines/actions/VirtualMachineActionFactory.tsx#L249
accessReview: asAccessReview(VirtualMachineSubresourcesModel, vm, 'update', 'pause'),

https://github.com/kubevirt-ui/kubevirt-plugin/blob/f8bde8849/src/views/virtualmachines/actions/VirtualMachineActionFactory.tsx#L273-L278
accessReview: asAccessReview(
  VirtualMachineInstanceSubresourcesModel,
  vm,
  'update',
  'restart',
),

Diagnostic Steps

  • Navigate to Console Debug (F12), then select Network and Filter for accessreview.
    Select the Virtual Machine and search each of the SelfSubjectAccessReview in the Payload.

  • On 4.20.x. It appears that Restart and Pause asAccessReview checks in the kubvirt-plugin are inverted.
    The subresources.kubevirt.io/virtualmachineinstances/restart but should be virtualmachines/restart and subresources.kubevirt.io/virtualmac

{"apiVersion":"authorization.k8s.io/v1","kind":"SelfSubjectAccessReview","spec":{"resourceAttributes":{"group":"subresources.kubevirt.io","resource":"virtualmachineinstances","subresource":"restart","verb":"update","name":"centos-stream9-ivory-cattle-78","namespace":"dev-test-doc"}}}
{"apiVersion":"authorization.k8s.io/v1","kind":"SelfSubjectAccessReview","spec":{"resourceAttributes":{"group":"subresources.kubevirt.io","resource":"virtualmachines","subresource":"pause","verb":"update","name":"centos-stream9-ivory-cattle-78","namespace":"dev-test-doc"}}}
  • Here on 4.21.x where problem is not observed.
{"apiVersion":"authorization.k8s.io/v1","kind":"SelfSubjectAccessReview","spec":{"resourceAttributes":{"group":"subresources.kubevirt.io","resource":"virtualmachines","subresource":"restart","verb":"update","name":"centos-stream9-lime-sheep-95","namespace":"dev-aziz-doc"}}}
{"apiVersion":"authorization.k8s.io/v1","kind":"SelfSubjectAccessReview","spec":{"resourceAttributes":{"group":"subresources.kubevirt.io","resource":"virtualmachineinstances","subresource":"pause","verb":"update","name":"centos-stream9-lime-sheep-95","namespace":"dev-aziz-doc"}}}
  • Component
  • cnv

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments