[Bug]: [privilege_group] "create_privilege_group" is forbidden when login with the user added in the role granted with the built-in privilege group "ClusterAdmin"

[binbinlv]

Is there an existing issue for this?

• I have searched the existing issues

Environment

- Milvus version: master-latest/2.4-latest
- Deployment mode(standalone or cluster): both
- MQ type(rocksmq, pulsar or kafka):  all  
- SDK version(e.g. pymilvus v2.0.0rc2):
- OS(Ubuntu or CentOS): 
- CPU/Memory: 
- GPU: 
- Others:

Current Behavior

"create_privilege_group" is forbidden when login with the user added in the role granted with the built-in privilege group "ClusterAdmin"

>>> utility.list_roles(True)
RoleInfo groups:
- RoleItem: <role_name:admin>, <users:()>
- RoleItem: <role_name:binbin>, <users:('user1',)>
- RoleItem: <role_name:public>, <users:()>
>>> utility.list_users(True)
UserInfo groups:
- UserItem: <username:root>, <roles:()>
- UserItem: <username:user1>, <roles:('binbin',)>
>>> role.list_grants()
GrantInfo groups:
- GrantItem: <object:Global>, <object_name:*>, <db_name:*>, <role_name:binbin>, <grantor_name:root>, <privilege:ClusterAdmin>
>>>
>>>
>>> connections.connect(host="***", user="user1", password="Milvus")
>>> role = Role("binbin")
>>> role.create_privilege_group("binbin4")
2024-12-14 12:45:59,233 [ERROR][handler]: grpc RpcError: [create_privilege_group], <_InactiveRpcError: StatusCode.PERMISSION_DENIED, PrivilegeCreatePrivilegeGroup: permission deny to user1 in the `default` database>, <Time:{'RPC start': '2024-12-14 12:45:59.207967', 'gRPC error': '2024-12-14 12:45:59.232434'}> (decorators.py:151)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/pymilvus/orm/role.py", line 285, in create_privilege_group
    return self._get_connection().create_privilege_group(privilege_group)
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/pymilvus/decorators.py", line 155, in handler
    raise e from e
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/pymilvus/decorators.py", line 137, in handler
    return func(*args, **kwargs)
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/pymilvus/decorators.py", line 176, in handler
    return func(self, *args, **kwargs)
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/pymilvus/decorators.py", line 90, in handler
    raise e from e
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/pymilvus/decorators.py", line 86, in handler
    return func(*args, **kwargs)
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/pymilvus/client/grpc_handler.py", line 2131, in create_privilege_group
    resp = self._stub.CreatePrivilegeGroup(req, wait_for_ready=True, timeout=timeout)
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_interceptor.py", line 277, in __call__
    response, ignored_call = self._with_call(
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_interceptor.py", line 332, in _with_call
    return call.result(), call
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_channel.py", line 438, in result
    raise self
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_interceptor.py", line 315, in continuation
    response, call = self._thunk(new_method).with_call(
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_interceptor.py", line 343, in with_call
    return self._with_call(
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_interceptor.py", line 332, in _with_call
    return call.result(), call
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_channel.py", line 438, in result
    raise self
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_interceptor.py", line 315, in continuation
    response, call = self._thunk(new_method).with_call(
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_interceptor.py", line 343, in with_call
    return self._with_call(
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_interceptor.py", line 332, in _with_call
    return call.result(), call
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_channel.py", line 438, in result
    raise self
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_interceptor.py", line 315, in continuation
    response, call = self._thunk(new_method).with_call(
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_channel.py", line 1178, in with_call
    return _end_unary_response_blocking(state, call, True, None)
  File "/Users/binbin/milvus_latest/lib/python3.8/site-packages/grpc/_channel.py", line 1004, in _end_unary_response_blocking
    raise _InactiveRpcError(state)  # pytype: disable=not-instantiable
grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
	status = StatusCode.PERMISSION_DENIED
	details = "PrivilegeCreatePrivilegeGroup: permission deny to user1 in the `default` database"
	debug_error_string = "UNKNOWN:Error received from peer  {grpc_message:"PrivilegeCreatePrivilegeGroup: permission deny to user1 in the `default` database", grpc_status:7, created_time:"2024-12-14T12:45:59.232184+08:00"}"

Expected Behavior

"create_privilege_group" is not forbidden when login with the user added in the role granted with the built-in privilege group "ClusterAdmin"

Steps To Reproduce

from pymilvus import connections
from pymilvus import CollectionSchema, FieldSchema
from pymilvus import Collection
from pymilvus import connections
from pymilvus import DataType
from pymilvus import Partition
from pymilvus import utility
from pymilvus import MilvusClient
from pymilvus import Role

connections.connect(host="***", user="root", password="Milvus")
client = MilvusClient(uri="http://***:19530", user="root", password="Milvus")
client.create_collection("binbin_new", dimension=128)
role = Role("binbin")
role.create()
utility.list_roles(True)
utility.create_user(user="user1", password="Milvus")
role.add_user("user1")
utility.list_roles(True)
role.list_grants()
role.grant_v2("ClusterAdmin", "*", "*")
connections.connect(host="***", user="user1", password="Milvus")
role = Role("binbin")
role.create_privilege_group("binbin_new_group")
print(res)

Milvus Log

https://grafana-4am.zilliz.cc/explore?orgId=1&left=%7B%22datasource%22:%22Loki%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22expr%22:%22%7Bcluster%3D%5C%22devops%5C%22,namespace%3D%5C%22chaos-testing%5C%22,pod%3D~%5C%22rbac-24-latest-qscdu.*%5C%22%7D%22%7D%5D,%22range%22:%7B%22from%22:%22now-1h%22,%22to%22:%22now%22%7D%7D

Anything else?

No response

[binbinlv]

And the "drop_privilege_group"/"add_privileges_to_group"/"remove_privileges_from_group"/ are forbiden which should not for "ClusterAdmin"

[binbinlv]

/assign @shaoting-huang

[sre-ci-robot]

@binbinlv: GitHub didn't allow me to assign the following users: shaoting-huang.

Note that only milvus-io members, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

/assign @shaoting-huang

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[binbinlv]

verification.

[binbinlv]

master:
verified and fixed.
milvus: master-20241218-fb0e6896-amd64

>>> role.grant_v2("ClusterAdmin", "*", "*")
>>> connections.connect(host="***", user="user1", password="Milvus")
>>> role = Role("binbin")
>>> role.create_privilege_group("binbin_new_group")
>>>
>>>
>>> role.list_privilege_groups()
>>> role.add_privileges_to_group("binbin_new_group", ["Insert"])
>>> role.remove_privileges_from_group("binbin_new_group", ["Insert"])
>>> role.list_privilege_groups()

[binbinlv]

2.4:
verified and fixed.
milvus: 2.4-20241218-b469999f-amd64

>>> role.grant_v2("ClusterAdmin", "*", "*")
>>> role.list_grants()
GrantInfo groups:
- GrantItem: <object:Global>, <object_name:*>, <db_name:*>, <role_name:binbin>, <grantor_name:root>, <privilege:ClusterAdmin>
>>>
>>>
>>> connections.connect(host="10.101.85.251", user="user1", password="Milvus")
>>> role = Role("binbin")
>>> role.create_privilege_group("binbin_new_group")
>>> role.list_privilege_groups()
>>> role.add_privileges_to_group("binbin_new_group", ["Insert"])
>>> role.remove_privileges_from_group("binbin_new_group", ["Insert"])
>>> role.drop_privilege_group("binbin_new_group")
>>> role.list_privilege_groups()