Skip to content

Commit adddd4f

Browse files
lexfreilexfrei
committed
feat(dashboard): add cluster-usage RBAC for the new admin page
The cluster-usage admin page in the dashboard reads cluster-scoped resources (nodes, pods, metrics.k8s.io) to render aggregate utilisation and a per-node table that includes arbitrary extended resources such as GPUs. The built-in 'edit' ClusterRole already bound to cozystack-cluster-admin via cozystack-dashboard-cluster-admin does not grant cluster-wide pod read or any access to 'nodes', so the dashboard needs an explicit grant for the page to render anything beyond an error. The page-side sidebar item is gated by SelfSubjectAccessReview on 'nodes list' — without this binding the gate fails closed and the entry stays invisible, which is the desired fallback for clusters that have not adopted the new RBAC yet. The chart intentionally does not add permissions for deeper sources (Prometheus, DCGM, HAMi). Those belong in their respective packages or operator-provided RBAC; the page detects them via discovery and gates each section with its own per-source review. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent 2fa15ce commit adddd4f

3 files changed

Lines changed: 104 additions & 0 deletions

File tree

‎packages/system/dashboard/templates/clusterrole-cluster-usage.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: cozystack-dashboard-cluster-usage
5+
rules:
6+
- apiGroups: [""]
7+
resources: ["nodes", "pods"]
8+
verbs: ["get", "list", "watch"]
9+
- apiGroups: ["metrics.k8s.io"]
10+
resources: ["nodes"]
11+
verbs: ["get", "list"]

‎packages/system/dashboard/templates/clusterrolebinding-cluster-usage.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: cozystack-dashboard-cluster-usage
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: ClusterRole
8+
name: cozystack-dashboard-cluster-usage
9+
subjects:
10+
- apiGroup: rbac.authorization.k8s.io
11+
kind: Group
12+
name: cozystack-cluster-admin

‎packages/system/dashboard/tests/cluster_usage_rbac_test.yaml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
suite: dashboard cluster-usage RBAC
2+
templates:
3+
- templates/clusterrole-cluster-usage.yaml
4+
- templates/clusterrolebinding-cluster-usage.yaml
5+
6+
release:
7+
name: dashboard
8+
namespace: cozy-dashboard
9+
10+
# The cluster-usage admin page in the dashboard reads cluster-scoped
11+
# resources (nodes, pods, metrics.k8s.io) to render aggregate utilisation
12+
# and a per-node table including arbitrary extended resources (GPUs etc.).
13+
# The built-in `edit` ClusterRole already bound to cozystack-cluster-admin
14+
# does not grant cluster-wide pod read or `nodes` access, so the dashboard
15+
# needs an explicit grant. The page-side sidebar item is gated by SSAR on
16+
# `nodes list` — pinning the rules here keeps that gate meaningful.
17+
18+
tests:
19+
- it: ClusterRole exists and grants nodes/pods get/list/watch
20+
template: templates/clusterrole-cluster-usage.yaml
21+
asserts:
22+
- isKind:
23+
of: ClusterRole
24+
- equal:
25+
path: apiVersion
26+
value: rbac.authorization.k8s.io/v1
27+
- equal:
28+
path: metadata.name
29+
value: cozystack-dashboard-cluster-usage
30+
- contains:
31+
path: rules
32+
content:
33+
apiGroups: [""]
34+
resources: ["nodes", "pods"]
35+
verbs: ["get", "list", "watch"]
36+
37+
- it: ClusterRole grants metrics.k8s.io nodes get/list
38+
template: templates/clusterrole-cluster-usage.yaml
39+
asserts:
40+
- contains:
41+
path: rules
42+
content:
43+
apiGroups: ["metrics.k8s.io"]
44+
resources: ["nodes"]
45+
verbs: ["get", "list"]
46+
47+
- it: ClusterRoleBinding binds the role to cozystack-cluster-admin group
48+
template: templates/clusterrolebinding-cluster-usage.yaml
49+
asserts:
50+
- isKind:
51+
of: ClusterRoleBinding
52+
- equal:
53+
path: apiVersion
54+
value: rbac.authorization.k8s.io/v1
55+
- equal:
56+
path: metadata.name
57+
value: cozystack-dashboard-cluster-usage
58+
- equal:
59+
path: roleRef.kind
60+
value: ClusterRole
61+
- equal:
62+
path: roleRef.name
63+
value: cozystack-dashboard-cluster-usage
64+
- equal:
65+
path: subjects[0].kind
66+
value: Group
67+
- equal:
68+
path: subjects[0].name
69+
value: cozystack-cluster-admin
70+
- equal:
71+
path: subjects[0].apiGroup
72+
value: rbac.authorization.k8s.io
73+
74+
- it: each template renders exactly one document
75+
asserts:
76+
- template: templates/clusterrole-cluster-usage.yaml
77+
hasDocuments:
78+
count: 1
79+
- template: templates/clusterrolebinding-cluster-usage.yaml
80+
hasDocuments:
81+
count: 1

0 commit comments

Comments
 (0)