-
Bug
-
Resolution: Done
-
Normal
-
ACM 2.10.0, ACM 2.11.0, ACM 2.12.0
-
None
-
0
-
False
-
None
-
False
-
Resolved an issue that could cause UI buttons to become disabled based on RBAC when the user has permission to perform the action
-
-
-
ACM Console Sprint 263
-
Moderate
-
Customer Facing
-
None
Description of problem:
Buttons that need to check if the user has permission in any namespace (such as create policy / policy set, create application, create automation template, and add credential) can erroneously become disabled or flip between enabled and disabled states.
Version-Release number of selected component (if applicable):
All versions going back to at least ACM 2.8 or earlier
How reproducible:
Consistently with the correct conditions
Steps to Reproduce:
- Set up a user without any permissions called viewer
- Grant the user permission to view all namespaces (get/watch/list only)
kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: view-namespaces rules: - verbs: - get - watch - list apiGroups: - '' resources: - namespaces --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: viewer-can-view-namespaces subjects: - kind: User apiGroup: rbac.authorization.k8s.io name: viewer roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: view-namespaces
- Grant the user admin access to a few namespaces (for example, create a Project as the user to automatically get the admin role on that namespace)
- Create around 400 namespaces (not as the limited user - the user should have permission to see these, but not create resources in them)
for i in {1..400}; do oc create namespace test-namespace-${i}; done
- View a page with a button on it, such as Add Credential or Create policy
- While viewing, delete or create some namespaces via the CLI (a bash loop may be useful)
Actual results:
The button becomes enabled after some delay, but then can flip back and forth a few times.
Expected results:
The button should not become disabled until the user does not have permission to create the resource in any namespace.
Additional info:
- clones
-
ACM-16018 Console buttons can be erroneously disabled due to RBAC
-
- Closed
-
- is cloned by
-
ACM-16020 Console buttons can be erroneously disabled due to RBAC [release-2.11]
-
- Closed
-
- links to
-
RHSA-2024:143822 Red Hat Advanced Cluster Management 2.12.2 bug fixes and container updates