-
Bug
-
Resolution: Done
-
Normal
-
None
-
Quality / Stability / Reliability
-
False
-
-
False
-
CLOSED
-
-
-
Moderate
-
None
+++ This bug was initially created as a clone of Bug #2140539 +++
Description of problem:
Disable all active elements on VM/Template pages if user have view only permission:
- disable VNC connecting/play button in overview tab
- disable the VNC connecting button in standalone view (by click "Open web console")
- disable "Take snapshot" in overview tab
- disable all edit button in details tab
- "environment" tab cannot be loaded, need to figure out what to show there. maybe just keep the top line "Include all values from existing config maps, secrets or service accounts (as disk)" and remove others
- Console tab, need to hide the login credentials and disable the VNC connecting
- disable "Add network interface" button
- disable "Add disk" button
- disable "Take snapshot" button in snapshot tab
- disable all actions (start/stop/restart/delete ...) in kebab action and action menu.
- apply above rules to templates as well
Version-Release number of selected component (if applicable):
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info:
— Additional comment from Guohua Ouyang on 2022-11-07 06:01:44 UTC —
Steps to Reproduce:
1. create a running vm in a project and a template by kubeadmin
2. create a non-admin user and assign view only permission to the project
$ oc adm policy add-role-to-user view test -n default
3. login with non-admin user "test"
4. view VM/template in view only project "default" in web console
— Additional comment from Dan Kenigsberg on 2022-11-07 06:32:43 UTC —
design note: we should not attempt to re-implement the permission model in GUI. "can the active user do X" questions should be delegated to the back-end.
— Additional comment from Ugo Palatucci on 2022-11-08 10:44:41 UTC —
about the VNC play/connect button there is a separate bug for that: https://bugzilla.redhat.com/show_bug.cgi?id=2140534