User or a group with built-in cluster.edit role will not be able to access specific CRD
If fluxcd is enabled in the cluster using TMC and user/group with cluster.edit role try to access the crd's in the namespace where fluxecd is deployed will fail with below error.
Error from server (Forbidden):
terraforms.infra.contrib.fluxcd.io
is forbidden: User “
[email protected]
” cannot list resource “terraforms” in API group “
infra.contrib.fluxcd.io
” in the namespace “dev1”: decision made by
impersonation-proxy.concierge.pinniped.dev
terraforms.infra.contrib.fluxcd.io
Cluster attached/created in TMC
Cluster.edit role will not have the permission to access the namespace.
Only Cluster.admin role will be able to access the cluster
Create the custom role and attach the role to the user/group
Here are the steps
-> Create a custom role under TMC->Administration->Role->Create custom role.
Before creating the role we need to make a note of existing permission for cluster.edit.
TMC->Administration->Role-> cluster.edit
-> Then create the customer role with additional k8s RBAC as per the below screenshot. ( including permission from the cluster.edit)
Name of the custom role - customer-cluster.edit ( you can provide any name)
Create a custom role under TMC->Administration->Role->Create custom role
-> Once the custom role gets created, you should be able to see it in Access Management.
TMC->Access management-> access policies