Child tenants see no default VM images — picker reads cozy-public PVCs directly instead of via an Option source #3110

Summary

Default VM images are visible only to the root tenant. Child tenants see an empty image list in the VM create form, so they cannot pick a default golden image.

Mechanism

The image picker reads PersistentVolumeClaims directly from the cozy-public namespace:

• apps/console/src/components/SourceField.tsx — useImageOptions() calls useK8sList with a hardcoded namespace: "cozy-public" and filters PVCs by the vm-default-images- prefix.

The console talks to the Kubernetes API as the logged-in user, so this list is subject to that user's RBAC. The default golden images are provisioned as PVCs/DataVolumes in cozy-public (platform vm-default-images package), but the shared tenant role bound in that namespace (cozy:tenant:dashboard) grants read only on Flux helmrepositories/helmcharts — not on persistentvolumeclaims. So a child-tenant identity gets an empty/forbidden list and sees no images, while the root-tenant identity (broader access) sees them. Hence the asymmetry.

Suggested fix

Serve the image list the same way storage classes, VM disks and instance types are now served — through the privileged, server-side Option resource (core.cozystack.io) introduced in #2778 — instead of a direct PVC read from cozy-public:

• Add an Option source (e.g. vmImage) computed server-side with privileged access, listing the vm-default-images-* entries from cozy-public.
• Annotate the image field in the VM schema with x-cozystack-options so it renders via DynamicOptionsWidget.
• Drop the bespoke useImageOptions PVC read in SourceField.tsx.

This routes around the tenant RBAC entirely (tenants need no read on cozy-public PVCs) and matches the pattern the rest of the form already uses. This depends on a backend Option source, mirroring how the dropdown migration in cozystack/cozystack-ui#30 depended on #2778.

Source

A user reported that the images of the default image package are only visible to the root tenant, not to child tenants.