From 2ac609fd6b90e818f8bf240140ecde2933f935d5 Mon Sep 17 00:00:00 2001 From: Scot Wells Date: Wed, 14 Oct 2026 14:55:42 -0500 Subject: [PATCH] fix: let resource readers read its status Milo now authorizes subresources on their own, with no fallback to the parent verb. A request for a resource's /status endpoint needs an explicit status.get grant, and no role granted one, so anyone who can read a resource is denied its status even though a normal get already returns the same data. Grant status.get on ExportPolicies to the telemetry viewer role, next to the existing get grant. The admin role inherits it. Status update and patch stay controller-only. --- config/operator/iam/roles/telemetry-viewer.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/config/operator/iam/roles/telemetry-viewer.yaml b/config/operator/iam/roles/telemetry-viewer.yaml index 25564fb..26c450c 100644 --- a/config/operator/iam/roles/telemetry-viewer.yaml +++ b/config/operator/iam/roles/telemetry-viewer.yaml @@ -10,6 +10,7 @@ spec: includedPermissions: - telemetry.miloapis.com/exportpolicies.list - telemetry.miloapis.com/exportpolicies.get + - telemetry.miloapis.com/exportpolicies/status.get - telemetry.miloapis.com/exportpolicies.watch # Subresource grants invalidate this role if subresource checks are off. - o11y.miloapis.com/logs.get