Description of problem: Disable all active elements on VM/Template pages if user have view only permission: - disable VNC connecting/play button in overview tab - disable the VNC connecting button in standalone view (by click "Open web console") - disable "Take snapshot" in overview tab - disable all edit button in details tab - "environment" tab cannot be loaded, need to figure out what to show there. maybe just keep the top line "Include all values from existing config maps, secrets or service accounts (as disk)" and remove others - Console tab, need to hide the login credentials and disable the VNC connecting - disable "Add network interface" button - disable "Add disk" button - disable "Take snapshot" button in snapshot tab - disable all actions (start/stop/restart/delete ...) in kebab action and action menu. - apply above rules to templates as well Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
Steps to Reproduce: 1. create a running vm in a project and a template by kubeadmin 2. create a non-admin user and assign view only permission to the project $ oc adm policy add-role-to-user view test -n default 3. login with non-admin user "test" 4. view VM/template in view only project "default" in web console
design note: we should not attempt to re-implement the permission model in GUI. "can the active user do X" questions should be delegated to the back-end.
about the VNC play/connect button there is a separate bug for that: https://bugzilla.redhat.com/show_bug.cgi?id=2140534
The issue is still on v4.12.0-172
The issue is still existing on CNV-v4.12.1-25
Close the bug until there is a request to backport this to 4.12.z