This bug has been migrated to another issue tracking site. It has been closed here and may no longer be being monitored.

If you would like to get updates for this issue, or to participate in it, you may do so at Red Hat Issue Tracker .
Bug 2143216 - Disable all active elements on VM and Template pages if user have view only permission
Summary: Disable all active elements on VM and Template pages if user have view only p...
Keywords:
Status: CLOSED MIGRATED
Alias: None
Product: Container Native Virtualization (CNV)
Classification: Red Hat
Component: User Experience
Version: 4.12.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: 4.14.0
Assignee: Ugo Palatucci
QA Contact: Guohua Ouyang
URL:
Whiteboard:
Depends On:
Blocks: 2140539
TreeView+ depends on / blocked
 
Reported: 2022-11-16 11:29 UTC by Ugo Palatucci
Modified: 2023-08-22 11:14 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 2140539
Environment:
Last Closed: 2023-08-22 11:13:33 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github kubevirt-ui kubevirt-plugin pull 978 0 None open Bug 2143216: Template with no edit permission 2022-11-21 14:23:25 UTC
Github kubevirt-ui kubevirt-plugin pull 988 0 None open Bug 2143216: Template disable pencil instead of remove it 2022-11-28 10:34:20 UTC
Red Hat Issue Tracker   CNV-22549 0 None None None 2023-08-22 11:13:32 UTC

Description Ugo Palatucci 2022-11-16 11:29:40 UTC 
+++ This bug was initially created as a clone of Bug #2140539 +++

Description of problem:
Disable all active elements on VM/Template pages if user have view only permission:
- disable VNC connecting/play button in overview tab
- disable the VNC connecting button in standalone view (by click "Open web console")
- disable "Take snapshot" in overview tab
- disable all edit button in details tab
- "environment" tab cannot be loaded, need to figure out what to show there. maybe just keep the top line "Include all values from existing config maps, secrets or service accounts (as disk)" and remove others
- Console tab, need to hide the login credentials and disable the VNC connecting
- disable "Add network interface" button 
- disable "Add disk" button
- disable "Take snapshot" button in snapshot tab
- disable all actions (start/stop/restart/delete ...) in kebab action and action menu.
- apply above rules to templates as well


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

--- Additional comment from Guohua Ouyang on 2022-11-07 06:01:44 UTC ---

Steps to Reproduce:
1. create a running vm in a project and a template by kubeadmin
2. create a non-admin user and assign view only permission to the project
$ oc adm policy add-role-to-user view test -n default
3. login with non-admin user "test"
4. view VM/template in view only project "default" in web console

--- Additional comment from Dan Kenigsberg on 2022-11-07 06:32:43 UTC ---

design note: we should not attempt to re-implement the permission model in GUI. "can the active user do X" questions should be delegated to the back-end.

--- Additional comment from Ugo Palatucci on 2022-11-08 10:44:41 UTC ---

about the VNC play/connect button there is a separate bug for that: https://bugzilla.redhat.com/show_bug.cgi?id=2140534
Comment 2 Guohua Ouyang 2022-11-23 04:12:50 UTC 
Failed to verify the bug on v4.13.0-1141
Comment 3 Guohua Ouyang 2022-12-13 07:32:52 UTC 
Failed to verify the bug on v4.13.0-1239
https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=2300990
Comment 5 Ugo Palatucci 2023-02-22 15:34:11 UTC 
Don't understand what's wrong @gouyang
Comment 6 Guohua Ouyang 2023-02-23 02:07:49 UTC 
(In reply to Ugo Palatucci from comment #5)
> Don't understand what's wrong @gouyang

The issue is still existing there, you can check it on cluster uit-413-dev with the regular user 'tests' under ns 'default'.
Note You need to log in before you can comment on or make changes to this bug.