rancher: Incorrect verb "read" versus "get" in clusterscan resource RBAC prevents correctly granting clusterscan permissions

What kind of request is this (question/bug/enhancement/feature request):

Bug

Steps to reproduce (least amount of steps as possible):

1. Create a Rancher v2.4.11 or v2.5.3 instance with a single all role custom cluster (I used https://github.com/superseb/tf-do-rancher2/).
2. Create a user foo
3. Create a custom Global role CIS, that grants get and list on cisbenchmarkversions.management.cattle.io and cisconfigs.management.cattle.io. Edit user foo and grant the custom CIS role.
4. Create a custom Cluster role Clusterscans, that grants get and list on clusterscans.management.cattle.io, and grant the user foo this role on the custom cluster.
5. As the admin user run a CIS Scan on the custom cluster.

Result:

• Logged in as the admin user observe once the CIS scan is complete that you can click the scan name to view the report details, and that viewing the scan in the API the links: report: field is populated.
• Logged in as the user foo observe that whilst the CIS Scan resource is listed, you cannot view the report details in the UI, and whilst you an access the v3/clusterScans/<cluster_id>:<report_id>/report API endpoint successfully, the links: report field in the v3/clusterScans/<cluster_id>:<report_id> endpoint is not populated (which is the reason the report details are not populated in the UI.

Other details that may be helpful:

The issue here is a result of the incorrect verb read versus the expected verb get in the API RBAC for the formatter that appends the report link to the clusterscan resource:

https://github.com/rancher/rancher/blob/v2.5.3/pkg/api/norman/customization/clusterscan/clusterscan.go#L28 https://github.com/rancher/rancher/blob/v2.4.11/pkg/api/customization/clusterscan/clusterscan.go#L26

Whilst an admin has * permission for all verbs, the defined custom role using the Kubernetes RBAC verb get does not match in the API check, hence the difference between the links: report: field returned for the admin user and the foo user. The verb in the API CanDo check should be updated to get to fix this issue. As a workaround the custom Clusterscans cluster role can be edited via the API to add the verb read to the list of permissions on clusterscans.management.cattle.io.

Environment information

• Rancher v2.4.11/v2.5.3

gz#13788