bad request permission: helm-chart:read

[jm-nab]

When using the v2 robots api:

/#/robot/CreateRobot

With the following curl request:

curl -X 'POST' \
  'http://test.local/api/v2.0/robots' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'X-Harbor-CSRF-Token: asdfasdf==' \
  -d '{
      "description": "The robot account for Test",
      "name": "test",
      "secret": "asdfasdf",
      "level": "project",
      "disable": false,
      "duration": 23110,
      "permissions": [
        {
          "kind": "project",
          "namespace": "test",
          "access": [
            {
              "action": "list",
              "resource": "repository",
              "effect": "allow"
            },
            {
              "action": "pull",
              "resource": "repository",
              "effect": "allow"
            },
            {
              "action": "read",
              "resource": "artifact",
              "effect": "allow"
            },
            {
              "action": "list",
              "resource": "artifact",
              "effect": "allow"
            },
            {
              "action": "list",
              "resource": "tag",
              "effect": "allow"
            },
            {
              "action": "read",
              "resource": "helm-chart",
              "effect": "allow"
            }
          ]
        }
      ]
    }'

I get the following error:

{
  "errors": [
    {
      "code": "BAD_REQUEST",
      "message": "bad request permission: helm-chart:read"
    }
  ]
}

What am I missing?

Related:

• harbor/api/v2.0/swagger.yaml

  Line 7764 in d25f355

  description: The resource of the access. Possible resources are *, artifact, artifact-addition, artifact-label, audit-log, catalog, configuration, distribution, garbage-collection, helm-chart, helm-chart-version, helm-chart-version-label, immutable-tag, label, ldap-user, log, member, metadata, notification-policy, preheat-instance, preheat-policy, project, quota, registry, replication, replication-adapter, replication-policy, repository, robot, scan, scan-all, scanner, system-volumes, tag, tag-retention, user, user-group or "" (for self-reference).

• harbor/src/server/v2.0/handler/robot.go

  Line 135 in d25f355

  // GET /api/v2.0/robots or GET /api/v2.0/robots?level=system to get all of system level robots.

• https://github.com/goharbor/harbor/blob/main/src/common/rbac/project/rbac_util.go#L27

harbor/src/server/v2.0/handler/robot.go

Line 306 in d25f355

return errors.New(nil).WithMessage("bad request permission: %s:%s", acc.Resource, acc.Action).WithCode(errors.BadRequestCode)

[jm-nab]

Looking at the policies map, i dont even see a helm-chart resource?

https://github.com/goharbor/harbor/blob/main/src/common/rbac/const.go#L84

[Vad1mo]

I guess you are looking at the latest harbor but expecting old behavior of chart museum times. Charts are now in OCI. So there is no destination between an image and a chart in OCI.

[jm-nab]

indeed, i'll try to update the PR, will put in draft. i had found this, and was just coming to that conclusion as well: 738fde7