From 4fa09d42db135b0bdd478d98b21d6ee0fdc7b087 Mon Sep 17 00:00:00 2001 From: Yahya Fakhroji Date: Tue, 6 Oct 2026 18:36:29 +0700 Subject: [PATCH] fix(iam): let organization viewers run resource searches The viewer, editor, and owner roles inherited no search role, so members held no resourcesearchqueries.create and every project search was denied. Viewer now inherits the searcher role, which carries only that permission. Editor and owner pick it up through viewer. --- .../assignable-organization-roles/roles/datum-cloud-viewer.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/assignable-organization-roles/roles/datum-cloud-viewer.yaml b/config/assignable-organization-roles/roles/datum-cloud-viewer.yaml index d530462..eedc944 100644 --- a/config/assignable-organization-roles/roles/datum-cloud-viewer.yaml +++ b/config/assignable-organization-roles/roles/datum-cloud-viewer.yaml @@ -28,6 +28,8 @@ spec: namespace: milo-system - name: activity.miloapis.com-viewer namespace: milo-system + - name: search.miloapis.com-searcher + namespace: milo-system - name: notes-viewer namespace: milo-system - name: identity-service-account-keys-viewer