]> git-server-git.apps.pok.os.sepia.ceph.com Git - ceph.git/commit
mgr/dashboard: fix access control permissions for roles
authorNizamudeen A <nia@redhat.com>
Wed, 5 Mar 2025 16:46:03 +0000 (22:16 +0530)
committerNizamudeen A <nia@redhat.com>
Tue, 3 Mar 2026 10:12:18 +0000 (15:42 +0530)
commit3098aca8ee3e5f373d2a70a872cebb5975a97f40
tree4a3d6fabb6e275af3024cc4aba62086e50e2b5ce
parentf1ac6cc4499567865c0f41aba4b04b40cd081cf2
mgr/dashboard: fix access control permissions for roles

Since prometheus is being used in the dashboard page we need to make
sure every role has prometheus read only access so that the dashboard
page can load the utilization metrics.

I also saw permission issue with the osd settings endpoint when its
trying to get the nearfull/full ratio. so instead of failing the entire
page i am proceeding with a chart that doesn't have those details when
the user doesn't have permission to access the config opt.

Multisite page was not accessible in the case of rgw-manager or
read-only user because its trying to show the status of rgw module. This
si also now gracefully handled to show the alert only when the user has
sufficient permission.

Fixes: https://tracker.ceph.com/issues/70331
Signed-off-by: Nizamudeen A <nia@redhat.com>
(cherry picked from commit f4bc03e4040ca32591d9b46b79309b162c3942db)

 Conflicts:
src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard/dashboard-v3.component.ts
 - kept changes only relavant to bug fix and ignored the other changes
   like h/w monitoring
src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-details/rgw-multisite-details.component.html
 - ignored multisite wizard changes
src/pybind/mgr/dashboard/frontend/src/app/core/navigation/administration/administration.component.html
 - kept the current changes since carbon is not there in squid which
   means this issue is not present
src/pybind/mgr/dashboard/frontend/src/app/core/navigation/navigation/navigation.component.html
 - kept the current changes for the same reason above
src/pybind/mgr/dashboard/services/access_control.py
 - ignored the SMB role manager and kept only what's available in squid
src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-pie/dashboard-pie.component.ts
src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard/dashboard-v3.component.html
src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard/dashboard-v3.component.ts
src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-details/rgw-multisite-details.component.html
src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-details/rgw-multisite-details.component.ts
src/pybind/mgr/dashboard/services/access_control.py