Unable to Add Permission to Namespaces - Permission to perform this operation was denied

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

When creating or editing an existing permission to a namespace under the Supervisor cluster, a long permission denied error message is returned.

The permission denied error message begins with the following line but lists a large number of missing privileges:

Permission to perform this operation was denied. You do not hold privileges "folder <folder UUID>"

 

The above noted folder UUID corresponds to the inventory object that already has permissions for the group or user you are attempting to add permissions for on the namespace.

 

You are assigning namespace permissions while logged in as a user or group that has the role SupervisorAdministrator.

Environment

vSphere Supervisor 9.x

VMware Cloud Foundation 9.x

Cause

Namespace permissions may require the SupervisorAdministrator role to modify or add permissions.

Role-based access control (RBAC) at the kubectl level can pull from Single Sign On (SSO) and Identity Provider (IDP) users or groups but requires that NamespaceOwner, NamespaceEdit or NamespaceView role is configured directly on the Namespace in the vSphere web UI. The system only creates the kubernetes RBAC rolebinding when one of these roles is successfully assigned at the namespace level.

This error message occurs because there is already a permission assigned for the given user or group at a higher level, such as the Supervisor inventory object.

Note: Kubernetes RBAC rolebindings are case-sensitive for the associated user or group.

Resolution

Resolution

VMware by Broadcom Engineering is working on providing a more clear, concise and meaningful error message.

 

Workaround

If there is a propagated permission to the namespace for the given user or group, ensure that the propagated permission is the same NamespacesOwner/Edit/View role at the source "Defined In" permission. To ensure that the kubernetes RBAC rolebinding is created, edit the propagated permission on the namespace and save it without making changes. This will update the propagated permission to use the namespace as its source "Defined In" and create the rolebinding in kubernetes.

Otherwise, ensure that the NamespacesOwner/Edit/View or SupervisorAdministrator role is only assigned at the Namespace for the given user or group.

Additional Information

"Forbidden cannot get resource "pods" in API group in the namespace" Unable to list pods or namespace with Supervisor Administrator Role on the Supervisor Folder

 

Note that Kubernetes RBAC rolebindings are case-sensitive. If there is a casing difference between the SSO and IDP users/groups, this can result in the rolebinding creating with different casing and kubectl commands will still fail with Forbidden errors.

As a workaround when adding the Namespace permission, you can select Domain: Custom and manually enter the correct casing for the intended user or group. This will result in a kubernetes RBAC rolebinding creating using that same casing.