Add get,list namespaces rule to system:user cluster role
This allows any user to implicitly list the namespaces and prevent
issues in the current implementation of the dashboard.
@@ -115,7 +115,7 @@ func setupClusterRoleBindings(store store.Store) error {
}
// The system:user ClusterRoleBinding grants permission found in the
- // cluster-admin ClusterRole to any user belonging to the cluster-admins group
+ // system:user ClusterRole to any user belonging to the system:users group
systemUser := &types.ClusterRoleBinding{
Name: "system:user",
RoleRef: types.RoleRef{
@@ -244,6 +244,12 @@ func setupClusterRoles(store store.Store) error {
Verbs: []string{"get", "update"},
Resources: []string{types.LocalSelfUserResource},
},
+ types.Rule{
+ Verbs: []string{"get", "list"},
+ Resources: []string{
+ "namespaces",
+ },
+ },
},
}
return store.CreateClusterRole(context.Background(), systemUser)
