-
Notifications
You must be signed in to change notification settings - Fork 256
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Monitoring v2] Links in Dashboard are un-clickable even the user has monitoring-ui-view permission #4466
Comments
Identical to backend issue filed in rancher/rancher#35311. |
Internal reference: SURE-4075. Updated rancher/rancher#35311 too, where it feels like the bulk of the work would have to be done for monitoring. |
What milestone should this be in? |
@catherineluse this is currently unscheduled though I'll sync up with @MKlimuszka since the related backend ticket shows more activity from the outside. |
Internal reference for docs: SURE-7044 and there's work to review the read-only permissions in the monitoring UI in SURE-7045 so there are limitations at present. |
Everything appears working as intended. A user with read-only project permission and the View Monitoring role shouldn't be able to use the links on the monitoring index (see rancher/rancher#43030 (comment)). With the fix in rancher/steve#132 visiting that page no longer causes a 500 error, the links are merely disabled as expected. I also confirmed that the workaround provided (moving the cattle-monitoring-system namespace) doesn't cause UI errors and the links become available. |
This was labeled a release note but I'm having some difficulty parsing the comment thread. Can somebody provide a summary for the note? |
A user with read-only project permission and the View Monitoring role shouldn't be able to use the links on the monitoring index (see rancher/rancher#43030 (comment)). |
Let me put it another way: If the UI is behaving as intended when users with such-and-such permissions can't view the links, why do we also have a work-around to circumvent that? Do we want to release note a work-around that gets around the intended behavior? |
From Slack
|
Hey guys, Im having a similar issue (the links in Dashboard are un-clickable) except that Im the admin (Default admin) of the k3s cluster ? Does anyone have any idea why? Thanks |
Setup
Describe the bug
User who is assigned the clusterRole
monitoring-ui-view
Should be able to click and open the URLs for Altermamgne, Grafana, Prometheus and etc. in the Monitoring Dashboard page in Cluster ExplorerTo Reproduce
Steps:
Result
Expected Result
These Links should be available
Screenshots
There is one failed call in the traffic:
Getting the endpoint for Alertmanager in the cattle-monitoring-system namespace is not needed for showing the links. Somehow the UI is trying to get some unnecessary resources which makes the links unavailable?
Update 1:
New tests show that:
the UI works as expected (links are available) when the user is assigned the
view monitoring
role via the old cluster management UI, but does not work if create theclusterRoleBinding
(monitoring-ui-view
,user-1
) via kubectl.in both cases, UI sends a GET request to
v1/endpoints/cattle-monitoring-system/rancher-monitoring-alertmanager
and fail with 403 forbiddenThe text was updated successfully, but these errors were encountered: