Adding VIEW role for a guest cluster namespace fails with error - "Add permission failed! A specified parameter was not correct: roleId"

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• When attempting to assign the view role to a user or group in the vSphere Client under Workload Management > Namespaces > Permissions, the operation fails with error-
  • "Add permission failed! A specified parameter was not correct: roleId"
• . The Namespace view role may work for Supervisor visibility but does not provide the required access to Guest Cluster resources (pods/logs) via kubectl

Environment

• VMware Cloud Foundation (VCF) 9.x
• vSphere Kubernetes Service (VKS)

Cause

By design, VIEW role is visible namespace permission. However, VIEW role is not added in the vCenter UI > Administration > Roles and Namespace View permission is for Supervisor level access.

Resolution

1. Log in to the Supervisor Cluster using an account with administrative privileges if logging to Supervisor Cluster with the jump server:
   • kubectl vsphere login --server [Supervisor_IP] --vsphere-username [email protected]
2. Login to the guest cluster and switch the context to Guest Cluster:
   •  kubectl vsphere login --server [Supervisor_IP] --vsphere-username [email protected] --tanzu-kubernetes-cluster-name [Cluster_Name] --tanzu-kubernetes-cluster-namespace [Namespace_Name]
3. Manually create a ClusterRoleBinding to map the SSO user/group to the native view ClusterRole:
   •  kubectl create clusterrolebinding [binding-name] --user sso:[username]@[domain] --clusterrole view
4. Verify access by logging in as the affected user and running:
   •  kubectl auth can-i list pods --all-namespaces