Skip to content

fix(dashboard): ClusterRoleBinding incloud-web-cluster-view references non-existent namespace incloud-web #2174

New issue
New issue
Closed
Closed
fix(dashboard): ClusterRoleBinding incloud-web-cluster-view references non-existent namespace incloud-web#2174
Labels
area/dashboardIssues or PRs related to the dashboard / UIkind/bugCategorizes issue or PR as related to a buglifecycle/staleDenotes an issue or PR has remained open with no activity and has become stalepriority/important-soonMust be staffed and worked on either currently, or very soon, ideally in time for the next releasetriage/acceptedIndicates an issue is ready to be actively worked on

Description

@IvanHunters
IvanHunters
opened on Mar 9, 2026

Describe the bug

The incloud-web-cluster-view ClusterRoleBinding in the cozy-dashboard Helm chart has a hardcoded namespace incloud-web in its subject, but the dashboard is deployed in the cozy-dashboard namespace. Since the incloud-web namespace does not exist, the binding is effectively a no-op — the incloud-web-web ServiceAccount gets no view ClusterRole permissions.

This breaks the "External IPs" section in the dashboard (Administration → External IPs), which relies on the BFF listing v1/services with fieldSelector=spec.type=LoadBalancer. The API server returns 403 Forbidden, resulting in an empty table with no data.

Reproduced on two independent clusters running Cozystack v1.0+.

Steps to reproduce

  1. Deploy Cozystack v1.0+ with the dashboard
  2. Navigate to Administration → External IPs in the dashboard
  3. Observe empty table with no data

Root cause

In the Helm chart template for the ClusterRoleBinding:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: incloud-web-cluster-view
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
- kind: ServiceAccount
  name: incloud-web-web
  namespace: incloud-web  # ← hardcoded, should be {{ .Release.Namespace }}

The namespace field should use the Helm release namespace (cozy-dashboard) instead of the hardcoded incloud-web.

Workaround

kubectl patch clusterrolebinding incloud-web-cluster-view \
  --type json \
  --patch '[{"op": "replace", "path": "/subjects/0/namespace", "value": "cozy-dashboard"}]'

Note: this workaround will be overwritten on the next Helm chart upgrade.

Expected behavior

The ClusterRoleBinding should reference the correct namespace where the dashboard ServiceAccount is deployed, and the External IPs section should display LoadBalancer services with their assigned IPs.

Environment

  • Cozystack version: v1.0+ (chart [email protected]+5a72d913e131)
  • Dashboard image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.1.0

Activity

  1. dosubot
    added
    kind/bugCategorizes issue or PR as related to a bug
    on Mar 9, 2026
  2. Aleksei Sviridkin (lexfrei)
    added
    area/dashboardIssues or PRs related to the dashboard / UI
    priority/important-soonMust be staffed and worked on either currently, or very soon, ideally in time for the next release
    triage/acceptedIndicates an issue is ready to be actively worked on
    on Apr 27, 2026

  3. dosubot commented on Jul 27, 2026

    @dosubot
    dosubotBot
    on Jul 27, 2026 – with DosuBot

    Hi, IvanHunters. I'm Dosu, and I'm helping the cozystack team manage their backlog and am marking this issue as stale.

    Issue Summary

    • The cozy-dashboard Helm chart’s incloud-web-cluster-view ClusterRoleBinding appears to hardcode the ServiceAccount namespace as incloud-web instead of cozy-dashboard.
    • Because of that namespace mismatch, the dashboard ServiceAccount does not receive the intended view permissions.
    • The reported symptom is that the External IPs page returns 403 errors and does not show LoadBalancer services.
    • There has been no additional discussion or follow-up activity on the issue.

    Next Steps

    • Please confirm whether this is still relevant on the latest version of the cozystack repository.
    • If it is still reproducible, you can keep the discussion open by commenting here; otherwise, this issue will be automatically closed in 7 days.

    Thanks for your understanding and contribution.

  4. dosubot
    added
    stale
    on Jul 27, 2026
  5. github-actions
    added
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    and removed
    stale
    on Aug 3, 2026

  6. myasnikovdaniil commented on Aug 15, 2026

    @myasnikovdaniil
    myasnikovdaniil
    on Aug 15, 2026
    Contributor

    Closing. The binding was fixed by becf8d7, and the BFF whose ServiceAccount it referenced no longer exists in the tree.

  7. myasnikovdaniil
    closed this as completedon Aug 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/dashboardIssues or PRs related to the dashboard / UIkind/bugCategorizes issue or PR as related to a buglifecycle/staleDenotes an issue or PR has remained open with no activity and has become stalepriority/important-soonMust be staffed and worked on either currently, or very soon, ideally in time for the next releasetriage/acceptedIndicates an issue is ready to be actively worked on

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions