Investigate Missing Permissions

[jonathanmeier5]

vSphere 7.0.2 appears to be missing several permissions that exist in vSphere 7.0.3:

ContentLibrary.AddCertToTrustStore
ContentLibrary.DeleteCertFromTrustStore
vSphereDataProtection.Protection
vSphereDataProtection.Recovery

The longer term solution here is probably to stop requiring Admin role on objects.

I think that if we add ContentLibrary.UpdateSession to our User role we might be able to deprecate the Admin roles altogether.

Note that despite the warning in CLI validations, missing these permissions will not block cluster creation.

[jdavid5815]

Hi,

We are running into the same issue. However, it doesn't appear as a warning, but as an error and the upgrade will NOT continue. It is in fact blocking us.

user XXX@YYY missing vSphere permissions	{"Permissions": "- username: XXX@YYY\n  objectType: Folder\n  path: /AAA/BBB/EKS_Anywhere\n  permissions:\n  - ContentLibrary.AddCertToTrustStore\n  - ContentLibrary.DeleteCertFromTrustStore\n  - vSphereDataProtection.Protection\n  - vSphereDataProtection.Recovery\n- username: XXX@YYY\n  objectType: VirtualMachine\n  path: /AAA/BBB/EKS_Anywhere/bottlerocket-vmware-k8s-1.26-x86_64-v1.14.3.ova\n  permissions:\n  - ContentLibrary.AddCertToTrustStore\n  - ContentLibrary.DeleteCertFromTrustStore\n  - vSphereDataProtection.Protection\n  - vSphereDataProtection.Recovery\n"}
❌ Validation failed	{"validation": "vsphere provider validation", "error": "validating vsphere user privileges: user XXX@YYY missing vSphere permissions", "remediation": ""}

[jonathanmeier5]

@jdavid5815
This validation was changed from a warning to an error in 0.17.0 when functionality was added to allow skipping it.

You can now use the --skip-validations vsphere-user-privilege flag in the upgrade and create commands.

[jdavid5815]

Thanks for the update. We already worked around the issue by downgrading eksa to version 0.16.5, where the validation still issues warnings instead of errors. Of course, the new flag is a better solution because it will allow us to use the latest version of eksa.

[csplinter]

Closing this due to inactivity