Tenant admins cannot upload images into VM disks (CDI upload forbidden by tenant RBAC) #3759

Description Users with the tenant admin role cannot upload an OS image into a VM disk within their own tenant. The upload fails with an RBAC Forbidden error, because the tenant admin role does not include permissions for the KubeVirt CDI upload API (upload.cdi.kubevirt.io / cdi.kubevirt.io). This blocks a basic tenant-level workflow: a tenant admin has to ask a platform administrator every time a custom image is needed. ## Steps to reproduce 1. Create a tenant and grant a user the tenant admin role. 2. Log in with that user's kubeconfig. 3. Try to upload an image into a VM disk: virtctl image-upload dv <disk-name> \ --size=10Gi \ --image-path=./image.qcow2 \ --namespace=tenant-<name> \ --uploadproxy-url=https://<cdi-uploadproxy> (same result via the Cozystack dashboard when creating a VM disk from an uploaded image) ## Expected behaviour A tenant admin can upload images into VM disks inside their own tenant namespace without involving a platform administrator. ## Actual behaviour The request is rejected with Error from server (Forbidden): ... is forbidden: User "..." cannot create resource ... (please replace with the exact error from your environment). ## Possible fix Add the missing rules to the tenant admin role: yaml - apiGroups: ["upload.cdi.kubevirt.io"] resources: ["uploadtokenrequests"] verbs: ["create"] - apiGroups: ["cdi.kubevirt.io"] resources: ["datavolumes", "datavolumes/source"] verbs: ["get", "list", "watch", "create", "update", "delete"] and make sure the cdi-uploadproxy endpoint is reachable for tenant users. ## Environment - Cozystack version: - Kubernetes version: - Installation method: