mgr/dashboard: grant pool read to cluster-manager role

Cluster-manager users were denied access to the CRUSH map page because
the underlying API requires pool read permission.

Fixes: https://tracker.ceph.com/issues/77952
Signed-off-by: Abhishek Desai <adesai@redhat.com>

diff --git a/src/pybind/mgr/dashboard/services/access_control.py b/src/pybind/mgr/dashboard/services/access_control.py
index 81b0995a1e997f04a91542fb5854bcb99766725b..a3dfb78fc2eb20bbad561f8662feaeefee03607d 100644 (file)
--- a/src/pybind/mgr/dashboard/services/access_control.py
+++ b/src/pybind/mgr/dashboard/services/access_control.py
@@ -253,6 +253,7 @@ CLUSTER_MGR_ROLE = Role(
     and config-opt scopes""", {
         Scope.HOSTS: [_P.READ, _P.CREATE, _P.UPDATE, _P.DELETE],
         Scope.OSD: [_P.READ, _P.CREATE, _P.UPDATE, _P.DELETE],
+        Scope.POOL: [_P.READ],
         Scope.MONITOR: [_P.READ, _P.CREATE, _P.UPDATE, _P.DELETE],
         Scope.MANAGER: [_P.READ, _P.CREATE, _P.UPDATE, _P.DELETE],
         Scope.CONFIG_OPT: [_P.READ, _P.CREATE, _P.UPDATE, _P.DELETE],

diff --git a/src/pybind/mgr/dashboard/tests/test_access_control.py b/src/pybind/mgr/dashboard/tests/test_access_control.py
index bd68733c1e37889967595f017831411355736177..c14f1ea72f5040b192685b1924fba02df2635442 100644 (file)
--- a/src/pybind/mgr/dashboard/tests/test_access_control.py
+++ b/src/pybind/mgr/dashboard/tests/test_access_control.py
@@ -159,6 +159,10 @@ class AccessControlTest(unittest.TestCase, CLICommandTestMixin):
             'allows read permission for all security scope except user, dashboard settings and config-opt'
         )
 
+    def test_cluster_manager_role_has_pool_read(self):
+        role = self.exec_cmd('ac-role-show', rolename='cluster-manager')
+        self.assertEqual(role['scopes_permissions'][Scope.POOL], [Permission.READ])
+
     def test_delete_system_role(self):
         with self.assertRaises(CmdException) as ctx:
             self.exec_cmd('ac-role-delete', rolename='administrator')