✨ feat(security): add Security surfaces to install modal and mission detail by clubanderson · Pull Request #8210 · kubestellar/console

clubanderson · 2026-04-15T19:09:14Z

Summary

Makes the security picture visible in-context at the two moments users care about — installing the Console itself and installing a CNCF project via a guided mission. Both surfaces link to `docs/security/SECURITY-MODEL.md` (merged in #8203) as the canonical reference.

This is the UI half of task 3 from the session todo — the docs half landed in #8203, the mermaid enhancement is in #8206, the schema side is in kubestellar/console-kb#2027.

What changes

Setup install modal — `SetupInstructionsDialog.tsx`

New expandable Security posture section alongside the existing Dev Guide / K8s Deploy / OAuth sections. Four subsections:

kc-agent runs on your machine, not ours — loopback bind, user kubeconfig RBAC, `KC_AGENT_TOKEN` optional shared secret
AI keys never leave your machine — `~/.kc/config.yaml` mode 0600, browser never holds the keys
What does leave your machine — AI chat history only, cluster secrets not auto-attached, analytics opt-outable
Air-gapped / high-security environments — `GROQ_BASE_URL` / `OPENROUTER_BASE_URL` / `OPEN_WEBUI_URL` overrides for local LLMs

Framed deliberately to not conflate with broader local-LLM support work (tracked separately as Manuela's feedback).

Mission Detail view — `MissionDetailView.tsx`

Adds a 5th tab: `install | uninstall | upgrade | troubleshooting | security`. The tab:

Renders `mission.security` steps via the existing `StepCard` component
When populated, adds a footer link to the overall `SECURITY-MODEL.md`
When empty (most missions today), shows a helpful fallback with the global doc link + a "Suggest security notes" button that reuses the existing `onImprove` flow

Schema — `types.ts`

Adds optional `security?: MissionStep[]` to the `MissionExport` interface. Backwards-compatible.

Locale — `locales/en/common.json`

Adds `missions.detail.tabs.security` and `missions.detail.tabs.securityEmpty` strings.

Paired PRs

#8203 (merged) — `docs/security/SECURITY-MODEL.md`
#8206 — mermaid diagrams for SECURITY-MODEL.md
kubestellar/console-kb#2027 — schema + populate `install-kubevirt.json` with 6 security bullets
kubestellar/docs (branch docs/console-security-model) — public-docs mirror page

Test plan

`npm run build` passes locally
No TypeScript errors
Render check: open SetupInstructionsDialog and verify the new Security section expands/collapses and links resolve
Render check: open any mission detail and verify the new Security tab renders; populated missions (install-kubevirt after console-kb#2027 merges) show the 6 bullets, others show the fallback

…detail Makes the security picture visible in-context at the two moments users care about — installing the Console itself and installing a CNCF project via a guided mission. Both surfaces link to the SECURITY-MODEL.md doc merged in #8203. Setup install modal (SetupInstructionsDialog.tsx): - New expandable "Security posture" section next to the Dev Guide / K8s Deploy / OAuth sections - Four subsections covering kc-agent posture, AI key handling, what leaves your machine, and the air-gapped / local-LLM option (framed as a security posture, not a feature gap — deliberately scoped to NOT conflate with the separate broader local-LLM support work) - "Read the full security model" link to docs/security/SECURITY-MODEL.md Mission Detail view (MissionDetailView.tsx): - New 5th tab: install / uninstall / upgrade / troubleshooting / **security** - Renders mission.security steps via the existing StepCard component - When mission.security is populated, adds a footer link to the overall SECURITY-MODEL.md so users always have a path to the full doc - When mission.security is empty, shows a helpful fallback with the global doc link and an "Suggest security notes" button (reuses the existing onImprove flow) Schema (lib/missions/types.ts): - Adds optional `security?: MissionStep[]` to the MissionExport interface. Backwards-compatible. Locale (locales/en/common.json): - Adds `missions.detail.tabs.security` and `missions.detail.tabs.securityEmpty` strings Paired with kubestellar/console-kb#2027 which introduces the schema-side `mission.security` array and populates the first mission (install-kubevirt). Signed-off-by: Andrew Anderson <[email protected]>

kubestellar-prow · 2026-04-15T19:09:18Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mikespreitzer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

netlify · 2026-04-15T19:09:20Z

✅ Deploy Preview for kubestellarconsole ready!

Name	Link
🔨 Latest commit	`6f912d5`
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/69dfe25dbecff1000838e10a
😎 Deploy Preview	https://deploy-preview-8210.console-deploy-preview.kubestellar.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

github-actions · 2026-04-15T19:09:50Z

👋 Hey @clubanderson — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

Claude Code (Opus 4.5 / 4.6) — recommended

GitHub Copilot

Cursor

Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

This is an automated message.

Copilot

Pull request overview

Adds in-context “Security” guidance to two key UI surfaces (local install modal and mission detail) and extends the mission schema/i18n to support mission-specific security steps, linking to docs/security/SECURITY-MODEL.md as the canonical reference.

Changes:

Adds an expandable “Security posture” section to SetupInstructionsDialog with a link to the security model doc.
Adds a new “Security” tab to MissionDetailView that renders mission.security steps or a fallback CTA when empty.
Extends MissionExport with optional security?: MissionStep[] and adds the required EN locale strings.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
web/src/components/setup/SetupInstructionsDialog.tsx	Adds an expandable “Security posture” guide with a doc link in the install modal.
web/src/components/missions/MissionDetailView.tsx	Adds a “Security” tab rendering `mission.security` steps plus doc link + fallback CTA.
web/src/lib/missions/types.ts	Extends `MissionExport` with optional `security` steps.
web/src/locales/en/common.json	Adds i18n strings for the new Security tab and empty state.

+                          <code className="font-mono text-foreground/70">0600</code>. The browser never holds the
+                          keys; kc-agent calls the provider directly. No API key reaches the console's servers or
+                          the hosted demo at console.kubestellar.io.


+                          kc-agent binds <code className="font-mono text-foreground/70">127.0.0.1:8585</code> only
+                          (hardcoded loopback, not configurable). It reads{' '}
+                          <code className="font-mono text-foreground/70">~/.kube/config</code> and executes every


github-actions · 2026-04-16T11:27:01Z

Thank you for your contribution! Your PR has been merged.

Check out what's new:

KubeStellar Console — Live multi-cluster dashboard
Marketplace — Community extensions
Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

…odel links Follow-up to #8210 which added the Security posture section to the install modal and a Security tab to the mission detail view. The original PR linked to the source-grounded repo version of SECURITY-MODEL.md — functional but less user-friendly than the rendered docs site, and missed the AI threat model entirely. Changes: SetupInstructionsDialog.tsx (Run KubeStellar Console Locally modal): - Primary security link now points at https://kubestellar.io/docs/console/main/console/security-model/ (rendered docs site, main version). - Added AI automation threat model link (SECURITY-AI.md from #8249) to surface prompt-injection / supply-chain / agent-drift concerns. - Kept the repo version as a secondary "source-grounded" link with smaller muted styling — useful for readers who want the exact file/line claims SECURITY-MODEL.md makes. MissionDetailView.tsx (mission security tab): - Same docs.kubestellar.io primary URL swap. - Added AI threat model link both to the populated-tab footer and the empty-state fallback. Three new URL constants replace the single hardcoded GH link: SECURITY_DOC_URL = docs.kubestellar.io (primary) SECURITY_DOC_REPO_URL = github.com/.../SECURITY-MODEL.md (secondary) SECURITY_AI_DOC_URL = github.com/.../SECURITY-AI.md Signed-off-by: Andrew Anderson <[email protected]>

github-actions · 2026-04-16T11:29:49Z

Post-merge build verification passed ✅

Both Go and frontend builds compiled successfully against merge commit 016d827d089496c8bcc5e13b5c03772d8e706eb8.

github-actions · 2026-04-16T11:34:30Z

✅ Post-Merge Verification: passed

Commit: 016d827d089496c8bcc5e13b5c03772d8e706eb8
Specs run: Missions.spec.ts mission-import.spec.ts smoke.spec.ts
Report: https://github.com/kubestellar/console/actions/runs/24507644772

…odel links (#8348) Follow-up to #8210 which added the Security posture section to the install modal and a Security tab to the mission detail view. The original PR linked to the source-grounded repo version of SECURITY-MODEL.md — functional but less user-friendly than the rendered docs site, and missed the AI threat model entirely. Changes: SetupInstructionsDialog.tsx (Run KubeStellar Console Locally modal): - Primary security link now points at https://kubestellar.io/docs/console/main/console/security-model/ (rendered docs site, main version). - Added AI automation threat model link (SECURITY-AI.md from #8249) to surface prompt-injection / supply-chain / agent-drift concerns. - Kept the repo version as a secondary "source-grounded" link with smaller muted styling — useful for readers who want the exact file/line claims SECURITY-MODEL.md makes. MissionDetailView.tsx (mission security tab): - Same docs.kubestellar.io primary URL swap. - Added AI threat model link both to the populated-tab footer and the empty-state fallback. Three new URL constants replace the single hardcoded GH link: SECURITY_DOC_URL = docs.kubestellar.io (primary) SECURITY_DOC_REPO_URL = github.com/.../SECURITY-MODEL.md (secondary) SECURITY_AI_DOC_URL = github.com/.../SECURITY-AI.md Signed-off-by: Andrew Anderson <[email protected]>

Copilot AI review requested due to automatic review settings April 15, 2026 19:09

kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Apr 15, 2026

kubestellar-prow Bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Apr 15, 2026

Copilot started reviewing on behalf of clubanderson April 15, 2026 19:10 View session

Copilot AI reviewed Apr 15, 2026

View reviewed changes

clubanderson merged commit 016d827 into main Apr 16, 2026
59 of 60 checks passed

kubestellar-prow Bot deleted the feat/security-ui-surfaces branch April 16, 2026 11:26

clubanderson mentioned this pull request Apr 16, 2026

📝 fix(security-links): point at docs.kubestellar.io + add AI threat model links #8348

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ feat(security): add Security surfaces to install modal and mission detail#8210

✨ feat(security): add Security surfaces to install modal and mission detail#8210
clubanderson merged 1 commit intomainfrom
feat/security-ui-surfaces

clubanderson commented Apr 15, 2026

Uh oh!

kubestellar-prow Bot commented Apr 15, 2026

Uh oh!

netlify Bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

clubanderson commented Apr 15, 2026

Summary

What changes

Setup install modal — `SetupInstructionsDialog.tsx`

Mission Detail view — `MissionDetailView.tsx`

Schema — `types.ts`

Locale — `locales/en/common.json`

Paired PRs

Test plan

Uh oh!

kubestellar-prow Bot commented Apr 15, 2026

Uh oh!

netlify Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kubestellarconsole ready!

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026

✅ Post-Merge Verification: passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify Bot commented Apr 15, 2026 •

edited

Loading