Skip to content

Commit 3a8a06b

Browse files
androndoandrondo
committed
fix(dashboard): let dashboard users read backup CRD schemas
The dashboard backup build/edit forms build each form from the CRD's OpenAPI schema, which useCRDSchema fetches directly from apiextensions.k8s.io with the logged-in user's token — a cluster-scoped get on the CRD by name. No role a tenant user carries granted customresourcedefinitions, so every tenant user hit a 403 on the schema lookup and the form never rendered, while kubectl kept working through the existing backup CR grants. The tenant personas are bound only by RoleBindings, which cannot authorize a cluster-scoped request, so the grant belongs on cozystack-dashboard-readonly: it is bound to system:authenticated by a ClusterRoleBinding and already carries the dashboard's other cluster-scoped reads. Add a get on the five backups.cozystack.io CRDs, scoped by resourceNames to those schemas only. Fixes: #4053 Assisted-By: LLM Signed-off-by: Andrey Kolkov <[email protected]>
1 parent 8a6fe02 commit 3a8a06b

1 file changed

Lines changed: 12 additions & 0 deletions

File tree

‎packages/system/dashboard/templates/rbac.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,18 @@ rules:
2828
- get
2929
- list
3030
- watch
31+
- apiGroups:
32+
- apiextensions.k8s.io
33+
resources:
34+
- customresourcedefinitions
35+
resourceNames:
36+
- plans.backups.cozystack.io
37+
- backupjobs.backups.cozystack.io
38+
- restorejobs.backups.cozystack.io
39+
- backups.backups.cozystack.io
40+
- backupclasses.backups.cozystack.io
41+
verbs:
42+
- get
3143
---
3244
apiVersion: rbac.authorization.k8s.io/v1
3345
kind: ClusterRoleBinding

0 commit comments

Comments
 (0)