[rke2 templates] unable to create cluster from an rke2 template as non-admin user

[slickwarren]

Rancher Server Setup

• Rancher version: v2.6-head (45dfeb4)
• Installation option (Docker install/Helm Chart): docker
  • If Helm Chart, Kubernetes Cluster and version (RKE1, RKE2, k3s, EKS, etc):
• Proxy/Cert Details:n/a

Information about the Cluster

• Kubernetes version:1.21.4+rke2r1
• Cluster Type (Local/Downstream):
  • If downstream, what type of cluster? (Custom/Imported or specify provider for Hosted/Infrastructure Provider): digital ocean, from rke2 template

Describe the bug

non-admin users are not able to create a cluster from rke2 cluster templates. Initial chart install fails

To Reproduce

• log in as non-admin user (restricted admin)
• add an rke2 cluster template repo
• using a template, create a cluster using valid parameters

Result

• currently, restricted admin gets this error when provisioning a cluster that the restricted admin has added:
• 
• the regular admin can use the same parameters to create a cluster from the template. Reopening for this issue, thought this might be a separate issue.

Expected Result

any user should be able to install from an rke2 cluster template

Screenshots

Additional context
found when testing rancher/dashboard#3995

[janeczku]

Reproduced in 2.6.1.

Expected but broken behavior:

A non-admin user that has been assigned the global "User-Base" and "Create Cluster" permissions is able to create clusters using RKE2 cluster templates configured by the Rancher admin.

Workaround

There oughta be a workaround by creating a custom role. can we find out what are the required permissions? @Jono-SUSE-Rancher @cbron

[janeczku]

Related: #35177

[jakefhyde]

Root cause

The create-clusters role did not have access to get/list/watch cluster repos, so non-admin users were not able to provision clusters with them.

What was fixed, or what changes have occurred

The create-clusters role was updated to allow the user to view these resources.

Areas or cases that should be tested

Creating a cluster using an rke2 template.

What areas could experience regressions?

N/A

Are the repro steps accurate/minimal?

As an admin user, add the cluster template examples repo. Create a user with the create-clusters role, and try to provision an rke2 cluster using the template.

[slickwarren]

tested as part of: #35177

tested on v2.6-head (c682e30):

• provision cluster from rke2 template as admin user -- pass
• provision cluster from rke2 template as standard user -- pass
• provision cluster from rke2 template as base user with create cluster role -- pass
• verify user only has access to their cloud credentials in rke2 template -- pass
• verify user can access rke2 template(s) added by admin -- pass

[belgaied2]

Related to #35184