Uploaded image for project: 'Red Hat Advanced Cluster Management'
  1. Red Hat Advanced Cluster Management
  2. ACM-16019

Console buttons can be erroneously disabled due to RBAC [release-2.12]

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Normal Normal
    • ACM 2.12.2
    • ACM 2.10.0, ACM 2.11.0, ACM 2.12.0
    • Console
    • None
    • 0
    • False
    • None
    • False
    • Resolved an issue that could cause UI buttons to become disabled based on RBAC when the user has permission to perform the action
    • ACM Console Sprint 263
    • Moderate
    • Customer Facing
    • None

      Description of problem:

      Buttons that need to check if the user has permission in any namespace (such as create policy / policy set, create application, create automation template, and add credential) can erroneously become disabled or flip between enabled and disabled states.

      Version-Release number of selected component (if applicable):

      All versions going back to at least ACM 2.8 or earlier

      How reproducible:

      Consistently with the correct conditions

      Steps to Reproduce:

      1. Set up a user without any permissions called viewer
      2. Grant the user permission to view all namespaces (get/watch/list only)
        kind: ClusterRole
        apiVersion: rbac.authorization.k8s.io/v1
        metadata:
          name: view-namespaces
        rules:
          - verbs:
              - get
              - watch
              - list
            apiGroups:
              - ''
            resources:
              - namespaces
        ---
        kind: ClusterRoleBinding
        apiVersion: rbac.authorization.k8s.io/v1
        metadata:
          name: viewer-can-view-namespaces
        subjects:
          - kind: User
            apiGroup: rbac.authorization.k8s.io
            name: viewer
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: view-namespaces
          
      1. Grant the user admin access to a few namespaces (for example, create a Project as the user to automatically get the admin role on that namespace)
      2. Create around 400 namespaces (not as the limited user - the user should have permission to see these, but not create resources in them)
        for i in {1..400}; do oc create namespace test-namespace-${i}; done
        
      3. View a page with a button on it, such as Add Credential or Create policy
      4. While viewing, delete or create some namespaces via the CLI (a bash loop may be useful)

      Actual results:

      The button becomes enabled after some delay, but then can flip back and forth a few times.

      Expected results:

      The button should not become disabled until the user does not have permission to create the resource in any namespace.

      Additional info:

              rh-ee-kcormier Kevin Cormier
              rh-ee-kcormier Kevin Cormier
              Atif Shafi Atif Shafi
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: