非admin在自己的企业空间的项目下的存储卷详情会弹出forbidden告警框

cqiang1993

kubernetes版本

Client Version: version.Info{Major:“1”, Minor:“20”, GitVersion:“v1.20.6”, GitCommit:“8a62859e515889f07e3e3be6a1080413f17cf2c3”, GitTreeState:“clean”, BuildDate:“2021-04-15T03:28:42Z”, GoVersion:“go1.15.10”, Compiler:“gc”, Platform:“linux/amd64”}

Server Version: version.Info{Major:“1”, Minor:“20”, GitVersion:“v1.20.4”, GitCommit:“e87da0bd6e03ec3fea7933c4b5263d151aafd07c”, GitTreeState:“clean”, BuildDate:“2021-02-18T16:03:00Z”, GoVersion:“go1.15.8”, Compiler:“gc”, Platform:“linux/amd64”}

kubesphere版本：

v3.2.2

操作系统版本：

CentOS 7.9

复现步骤：

创建一个账号绑定企业空间，并且设置为企业空间管理员

通过创建的账号进入企业空间，进入项目，打开存储卷管理

任意选择一个存储卷点击进入

接口请求：

/apis/snapshot.storage.k8s.io/v1beta1/volumesnapshotclasses

响应为：

{

“kind”: “Status”,

“apiVersion”: “v1”,

“metadata”: {

“status”: “Failure”,

“message”: "volumesnapshotclasses.snapshot.storage.k8s.io is forbidden: User \“cqiang1993\” cannot list resource \“volumesnapshotclasses\” in API group \“snapshot.storage.k8s.io\” at the cluster scope",

“reason”: “Forbidden”,

“details”: {

"group": "snapshot.storage.k8s.io",

"kind": "volumesnapshotclasses"

“code”: 403

}

Nrehearsal

执行下这个命令，贴一下输出

kubectl get workspacerolebindings -o json |  jq '.items[] | select(try .metadata.name | contains("cqiang")) | .roleRef'

cqiang1993

Nrehearsal 没有输出如何东西

Nrehearsal

cqiang1993
用有问题的账户，进入有问题的企业空间，然后将下面信息截图贴一下

cqiang1993

Nrehearsal

kubectl get workspacerole fxyc-enterprise-admin -o yaml
kubectl get workspacerolebinding cqiang1993-fxyc-enterprise-admin -o yaml

再看看这俩

cqiang1993

Nrehearsal

kubectl get workspacerole fxyc-enterprise-admin -o yaml 这个命令返回
apiVersion: iam.kubesphere.io/v1alpha2
kind: WorkspaceRole
metadata:
  annotations:
    iam.kubesphere.io/aggregation-roles: '["role-template-manage-workspace-settings","role-template-view-workspace-settings","role-template-manage-projects","role-template-view-projects","role-template-create-projects","role-template-create-devops","role-template-view-devops","role-template-manage-devops","role-template-manage-app-templates","role-template-view-app-templates","role-template-manage-app-repos","role-template-view-app-repos","role-template-view-members","role-template-manage-members","role-template-manage-roles","role-template-view-roles","role-template-manage-groups","role-template-view-groups"]'
    kubesphere.io/creator: system
  creationTimestamp: "2022-04-21T06:54:18Z"
  generation: 1
  labels:
    kubesphere.io/workspace: fxyc-enterprise
  managedFields:
  - apiVersion: iam.kubesphere.io/v1alpha2
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:iam.kubesphere.io/aggregation-roles: {}
          f:kubesphere.io/creator: {}
        f:labels:
          .: {}
          f:kubesphere.io/workspace: {}
        f:ownerReferences:
          .: {}
          k:{"uid":"14d055be-03e9-4fff-a2fa-847806afefe8"}:
            .: {}
            f:apiVersion: {}
            f:blockOwnerDeletion: {}
            f:controller: {}
            f:kind: {}
            f:name: {}
            f:uid: {}
      f:rules: {}
    manager: controller-manager
    operation: Update
    time: "2022-04-21T06:54:18Z"
  name: fxyc-enterprise-admin
  ownerReferences:
  - apiVersion: tenant.kubesphere.io/v1alpha2
    blockOwnerDeletion: true
    controller: true
    kind: WorkspaceTemplate
    name: fxyc-enterprise
    uid: 14d055be-03e9-4fff-a2fa-847806afefe8
  resourceVersion: "34017157"
  uid: ded99353-1f26-4000-9600-3b46786f8223
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
kubectl get workspacerolebinding cqiang1993-fxyc-enterprise-admin -o yaml 这个返回
Error from server (NotFound): workspacerolebindings.iam.kubesphere.io "cqiang1993-fxyc-enterprise-admin" not found

Nrehearsal

cqiang1993

如果cqiang1993 是 fxyc-enterprise-admin 这个角色，就会有一条cqiang1993-fxyc-enterprise-admin 的 workspacerolebinding 记录，你的环境里没有，应该是哪个步骤不太正确。

你参考这个文档做一下试验吧

下面这个就是我按照你的描述，创建的用户，就有larryhuang-s1-admin 的 workspacerolebinding

apiVersion: iam.kubesphere.io/v1alpha2
kind: WorkspaceRoleBinding
metadata:
  creationTimestamp: "2022-06-08T10:46:55Z"
  generation: 1
  labels:
    iam.kubesphere.io/user-ref: larryhuang
    kubesphere.io/workspace: s1
  name: larryhuang-s1-admin
  ownerReferences:
  - apiVersion: tenant.kubesphere.io/v1alpha2
    blockOwnerDeletion: true
    controller: true
    kind: WorkspaceTemplate
    name: s1
    uid: 0074fd8f-aad4-46a6-b04b-9e3a772396ba
  resourceVersion: "2400976"
  uid: a94bed7c-e0ab-4e66-be4c-163e64d6365f
roleRef:
  apiGroup: iam.kubesphere.io
  kind: WorkspaceRole
  name: s1-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: larryhuang