Rest permission issues

[rahulguptajss]

As mentioned in issue #3359, there are pending issues related to REST role permissionsrelated to leases privilege approach.

harvest2-role

time=2024-12-05T17:24:07.132+05:30 level=ERROR source=collector.go:422 msg="Entering standby mode" Poller=dc-1 collector=Rest:Support error="failed to fetch data: error making request StatusCode: 403, Error: Permission denied, Message: not authorized for that command, API: /api/support/autosupport?fields=enabled%2Cis_minimal%2Ctransport&ignore_unknown_fields=true&max_records=500&return_records=true" task=data

harvest-rest-role

time=2024-12-05T17:29:27.505+05:30 level=ERROR source=collector.go:422 msg="Entering standby mode" Poller=dc-1 collector=Rest:SnapshotPolicy error="failed to fetch data: error making request StatusCode: 403, Error: Permission denied, Message: not authorized for that command, API: /api/private/cli/snapshot/policy?fields=comment%2Cpolicy%2Ctotal_schedules%2Cvserver&ignore_unknown_fields=true&max_records=500&return_records=true" task=data
time=2024-12-05T17:29:27.560+05:30 level=ERROR source=collector.go:422 msg="Entering standby mode" Poller=dc-1 collector=Rest:Support error="failed to fetch data: error making request StatusCode: 403, Error: Permission denied, Message: not authorized for that command, API: /api/support/autosupport?fields=enabled%2Cis_minimal%2Ctransport&ignore_unknown_fields=true&max_records=500&return_records=true" task=data

There is another entry below, used in exports.yaml, which is disabled by default.

security login rest-role create -role harvest-rest-role -access readonly -api /api/private/cli/export-policy/rule

Error: command failed: failed to set field "cmddirname" to "export-policy rule"

Below are 3 JIRA for tracking the same

• CONTAP-363810 (Workaround done via PR #3391 )
• CONTAP-363818
• CONTAP-364232 (Workaround done via PR #3392)

[rahulguptajss]

As mentioned in CONTAP-363810, As a workaround, we can use api/private/cli/volume/snapshot/policy instead of /api/private/cli/snapshot/policy.

[mamoep]

Export-policy is working via
security login rest-role create -role harvest-rest-role -access readonly -api /api/private/cli/vserver/export-policy/rule

[rahulguptajss]

Export-policy is working via security login rest-role create -role harvest-rest-role -access readonly -api /api/private/cli/vserver/export-policy/rule

Thanks. Yes It is. We'll update it!