From: Abhishek Desai Date: Mon, 6 Jul 2026 10:42:58 +0000 (+0530) Subject: mgr/dashboard: grant pool read to cluster-manager role X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=4bdd697d0286f2af32ef36aeae42299bdf5d745d;p=ceph.git mgr/dashboard: grant pool read to cluster-manager role Cluster-manager users were denied access to the CRUSH map page because the underlying API requires pool read permission. Fixes: https://tracker.ceph.com/issues/77952 Signed-off-by: Abhishek Desai --- diff --git a/src/pybind/mgr/dashboard/services/access_control.py b/src/pybind/mgr/dashboard/services/access_control.py index 81b0995a1e9..a3dfb78fc2e 100644 --- a/src/pybind/mgr/dashboard/services/access_control.py +++ b/src/pybind/mgr/dashboard/services/access_control.py @@ -253,6 +253,7 @@ CLUSTER_MGR_ROLE = Role( and config-opt scopes""", { Scope.HOSTS: [_P.READ, _P.CREATE, _P.UPDATE, _P.DELETE], Scope.OSD: [_P.READ, _P.CREATE, _P.UPDATE, _P.DELETE], + Scope.POOL: [_P.READ], Scope.MONITOR: [_P.READ, _P.CREATE, _P.UPDATE, _P.DELETE], Scope.MANAGER: [_P.READ, _P.CREATE, _P.UPDATE, _P.DELETE], Scope.CONFIG_OPT: [_P.READ, _P.CREATE, _P.UPDATE, _P.DELETE], diff --git a/src/pybind/mgr/dashboard/tests/test_access_control.py b/src/pybind/mgr/dashboard/tests/test_access_control.py index bd68733c1e3..c14f1ea72f5 100644 --- a/src/pybind/mgr/dashboard/tests/test_access_control.py +++ b/src/pybind/mgr/dashboard/tests/test_access_control.py @@ -159,6 +159,10 @@ class AccessControlTest(unittest.TestCase, CLICommandTestMixin): 'allows read permission for all security scope except user, dashboard settings and config-opt' ) + def test_cluster_manager_role_has_pool_read(self): + role = self.exec_cmd('ac-role-show', rolename='cluster-manager') + self.assertEqual(role['scopes_permissions'][Scope.POOL], [Permission.READ]) + def test_delete_system_role(self): with self.assertRaises(CmdException) as ctx: self.exec_cmd('ac-role-delete', rolename='administrator')