-
Notifications
You must be signed in to change notification settings - Fork 44
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Pull through cache permissions do not allow pulling images #1624
Comments
When pulling images through a pull-through cache distribution, you also need to have permissions to create distributions. Being only a consumer does not help in this matter. The user needs to have permissions of the creator too. Do you think you can create a role that has also permissions to create a distribution ? I have in mind the following permissions:
I suppose we need to update our documentation... ref: https://staging-docs.pulpproject.org/pulp_container/docs/admin/learn/rbac/#creator-role |
Additionally, the user needs permission to access the namespace, like:
|
Thank you! I was able to pull a container after creating a role with those permissions.
|
To be honest, you only need the
ERROR:
Adding permissions:
Success:
|
I see there is a lack of clarity on how the permissions should be configured and how should the pull-through caching work out of the box. I consider this to be a documentation issue. Thanks for opening it! As per #1623, we need to discuss the impact of allowing all users to benefit from pull-through caching distributions. |
We will need to consider adding write permissions to the repository as well, not just view permissions. |
Version
pulp-core: 3.53.0
pulp-container: 2.20.0
Describe the bug
I created a new user so that I could login and pull images from a pull through cache. This is needed because of this bug.
Here is the distribution
The distribution shows the role and user have been applied.
However when I login and pull it will still fail
Expected behavior
The role should allow the user to pull the images
Additional context
Previous Discussion: https://matrix.to/#/!HWvLQmBGVPfJfTQBAu:matrix.org/$xdzKq3fygVI6w0ginypdtaodaRJhi7Yx6aMTgSowSP0?via=matrix.org&via=ctrl-c.liu.se&via=x9c4.spdns.org
The text was updated successfully, but these errors were encountered: