Enforces role-based access on the tenant cluster terminal.
Terminal access
The tenant terminal previously admitted any team member, so a viewer could open an interactive shell. Access is now resolved from Team CRDs and gated by role:
- Write-capable roles (team admin, operator, platform admin) get the interactive shell, unchanged.
- Viewers connect read-only: they stream output but their input is dropped server-side.
- Non-members are refused before the connection upgrades.
Authorization boundary
Write-capable roles run the shell under the tenant cluster-admin credential. A scoped operator identity is possible later and would change only the credential selection seam. Because write-capable roles share that credential, each terminal session now logs the Butler user, role, team, cluster, and duration on open and close for attribution.
Deployment
Helm chart butler-console-v0.14.2 advances the pinned server image to 0.22.0.
Full Changelog: v0.21.1...v0.22.0