From fa10af43883e5c63af01e42939895e8dfe774362 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Thu, 29 Jan 2026 04:15:33 -0500
Subject: [PATCH 01/36] Update applications.vue

---
 dashboard/pkg/epinio/detail/applications.vue | 56 ++++++++++++++++----
 1 file changed, 46 insertions(+), 10 deletions(-)

diff --git a/dashboard/pkg/epinio/detail/applications.vue b/dashboard/pkg/epinio/detail/applications.vue
index b4d0a98a..535a33f5 100644
--- a/dashboard/pkg/epinio/detail/applications.vue
+++ b/dashboard/pkg/epinio/detail/applications.vue
@@ -34,7 +34,8 @@ const store = useStore();
 
 const t = store.getters['i18n/t'];
 
-const saving = ref(false);
+const scalingInFlight = ref(false);
+const debouncePending = ref(false);
 const gitSource = ref<any>(null);
 const gitDeployment = ref({
   deployedCommit: { short: '', long: '' },
@@ -124,6 +125,10 @@ const commitActions = [{
   enabled: true
 }];
 
+// Debounce settings for scaling instances
+const UPDATE_INSTANCES_DEBOUNCE_MS = 1000; // 1s; adjust as needed
+let updateInstancesTimeout: number | null = null;
+
 onMounted(async () => {
   await store.dispatch('epinio/findAll', { type: EPINIO_TYPES.SERVICE_INSTANCE });
   await store.dispatch('epinio/findAll', { type: EPINIO_TYPES.CONFIGURATION });
@@ -135,17 +140,35 @@ onMounted(async () => {
 });
 
 async function updateInstances(newInstances: number) {
-  saving.value = true;
-  try {
-    props.value.configuration.instances = newInstances;
-    await props.value.update();
-    await props.value.forceFetch();
-  } catch (err) {
-    console.error(`Failed to scale Application: `, epinioExceptionToErrorsArray(err));
+  // Update desired and configured instances immediately so the UI reflects the target
+  props.value.desiredInstances = newInstances;
+  props.value.configuration.instances = newInstances;
+
+  // Debounce the API call so rapid clicks collapse into one request
+  if (updateInstancesTimeout !== null) {
+    clearTimeout(updateInstancesTimeout);
   }
-  saving.value = false;
+  debouncePending.value = true;
+
+  updateInstancesTimeout = window.setTimeout(async () => {
+    debouncePending.value = false;
+    scalingInFlight.value = true;
+
+    try {
+      await props.value.update();
+      await props.value.forceFetch();
+    } catch (err) {
+      console.error('[Epinio instances] Failed to scale Application', epinioExceptionToErrorsArray(err));
+    } finally {
+      scalingInFlight.value = false;
+      debouncePending.value = false;
+      updateInstancesTimeout = null;
+    }
+  }, UPDATE_INSTANCES_DEBOUNCE_MS);
 }
 
+const showScaleSpinner = computed(() => debouncePending.value || scalingInFlight.value);
+
 function formatURL(str: string) {
   const matchGit = str.match('^(https|git)(:\/\/|@)([^\/:]+)[\/:]([^\/:]+)\/(.+)(.git)*$'); // eslint-disable-line no-useless-escape
   return `${matchGit?.[4]}/${matchGit?.[5]}`;
@@ -333,10 +356,16 @@ const commitPosition = computed(() => {
                 <PlusMinus
                   v-model:value="value.desiredInstances"
                   class="mt-15 mb-10"
-                  :disabled="saving"
+                  :disabled="scalingInFlight"
                   @minus="updateInstances(value.desiredInstances - 1)"
                   @plus="updateInstances(value.desiredInstances + 1)"
                 />
+                <div
+                  v-if="showScaleSpinner"
+                  class="scale-instances__spinner mt-5"
+                >
+                  <i class="icon-spinner animate-spin" />
+                </div>
               </div>
 
               <div class="deployment__origin__row">
@@ -746,6 +775,13 @@ const commitPosition = computed(() => {
   }
 }
 
+.scale-instances__spinner {
+  display: inline-flex;
+  align-items: center;
+  font-size: 12px;
+  color: var(--muted-text);
+}
+
 .deployment__origin__list {
   ul {
     margin: 0;

From a119b684eade87c2e451e92fb23ac3fd3d389949 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Fri, 30 Jan 2026 01:36:36 -0500
Subject: [PATCH 02/36] download buton added in system->about

---
 dashboard/pkg/epinio/l10n/en-us.yaml          |  7 ++
 .../pkg/epinio/pages/c/_cluster/about.vue     | 95 +++++++++++++++++++
 2 files changed, 102 insertions(+)

diff --git a/dashboard/pkg/epinio/l10n/en-us.yaml b/dashboard/pkg/epinio/l10n/en-us.yaml
index 71e55b1d..af25bd08 100644
--- a/dashboard/pkg/epinio/l10n/en-us.yaml
+++ b/dashboard/pkg/epinio/l10n/en-us.yaml
@@ -65,6 +65,13 @@ epinio:
   about:
     allPackages: See all packages
     getBinaries: Get binaries
+  downloadReport:
+    title: Download report
+    action: Download Report
+    success: Report downloaded successfully
+    errors:
+      unauthorized: You need admin permissions to download the report
+      failed: Failed to download report. Please try again or contact support
   supportBundle:
     title: Download support bundle
     description: Collect a troubleshooting bundle for support.
diff --git a/dashboard/pkg/epinio/pages/c/_cluster/about.vue b/dashboard/pkg/epinio/pages/c/_cluster/about.vue
index 956ad8c7..371f5e33 100644
--- a/dashboard/pkg/epinio/pages/c/_cluster/about.vue
+++ b/dashboard/pkg/epinio/pages/c/_cluster/about.vue
@@ -19,6 +19,10 @@ const supportBundleLoading = ref(false);
 const supportBundleError = ref('');
 const supportBundleSuccess = ref('');
 
+const reportLoading = ref(false);
+const reportError = ref('');
+const reportSuccess = ref('');
+
 const t = store.getters['i18n/t'];
 
 const aboutVersionsComponentString = computed(() => t('about.versions.component'));
@@ -106,6 +110,46 @@ const bundleFileName = () => {
   return `epinio-support-bundle-${ now.getFullYear() }-${ pad(now.getMonth() + 1) }-${ pad(now.getDate()) }-${ pad(now.getHours()) }-${ pad(now.getMinutes()) }-${ pad(now.getSeconds()) }.tar.gz`;
 };
 
+const reportFileName = () => {
+  const now = new Date();
+  const pad = (val: number) => val.toString().padStart(2, '0');
+
+  return `epinio-report-${ now.getFullYear() }-${ pad(now.getMonth() + 1) }-${ pad(now.getDate()) }-${ pad(now.getHours()) }-${ pad(now.getMinutes()) }-${ pad(now.getSeconds()) }.txt`;
+};
+
+const downloadReport = async() => {
+  reportError.value = '';
+  reportSuccess.value = '';
+  reportLoading.value = true;
+
+  try {
+    const res = await store.dispatch('epinio/request', {
+      opt: {
+        url:          '/api/v1/report/nodes',
+        method:       'get',
+        params:       { format: 'text' },
+        responseType: 'blob',
+        timeout:      60000
+      }
+    });
+
+    const blob = res?.data;
+    const contentType = res?.headers?.['content-type'] || 'text/plain; charset=utf-8';
+
+    await downloadFile(reportFileName(), blob, contentType);
+
+    reportSuccess.value = t('epinio.downloadReport.success');
+  } catch (err: any) {
+    const status = err?._status || err?.status || err?.response?.status;
+
+    reportError.value = status === 403
+      ? t('epinio.downloadReport.errors.unauthorized')
+      : t('epinio.downloadReport.errors.failed');
+  } finally {
+    reportLoading.value = false;
+  }
+};
+
 const downloadSupportBundle = async() => {
   const safeTail = sanitizeTail(tailLines.value);
 
@@ -213,6 +257,38 @@ const downloadSupportBundle = async() => {
       </a>
     </template>
 
+    <section
+      v-if="version"
+      class="download-report"
+    >
+      <h3>{{ t('epinio.downloadReport.title') }}</h3>
+
+      <div class="download-report__actions">
+        <button
+          class="btn role-primary"
+          :disabled="reportLoading"
+          @click="downloadReport"
+        >
+          <i
+            v-if="reportLoading"
+            class="icon-spinner animate-spin mr-5"
+          />
+          {{ t('epinio.downloadReport.action') }}
+        </button>
+      </div>
+
+      <Banner
+        v-if="reportSuccess"
+        color="success"
+        :label="reportSuccess"
+      />
+      <Banner
+        v-if="reportError"
+        color="error"
+        :label="reportError"
+      />
+    </section>
+
     <section
       v-if="version"
       class="support-bundle"
@@ -307,6 +383,25 @@ const downloadSupportBundle = async() => {
   }
 }
 
+.download-report {
+  margin-top: 40px;
+  padding: 16px;
+  border: 1px solid var(--border);
+  border-radius: var(--border-radius);
+  background: var(--default);
+
+  &__actions {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    margin-top: 16px;
+  }
+
+  .banner {
+    margin-top: 10px;
+  }
+}
+
 .support-bundle {
   margin-top: 40px;
   padding: 16px;

From 99edfd08774b3060b520ce4f830e52fad4e138b1 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Thu, 5 Feb 2026 01:50:29 -0500
Subject: [PATCH 03/36] Update ExportAppDialog.vue

---
 .../pkg/epinio/dialog/ExportAppDialog.vue     | 66 ++++++++++++++++---
 1 file changed, 58 insertions(+), 8 deletions(-)

diff --git a/dashboard/pkg/epinio/dialog/ExportAppDialog.vue b/dashboard/pkg/epinio/dialog/ExportAppDialog.vue
index 42de74a3..9a34d2cd 100644
--- a/dashboard/pkg/epinio/dialog/ExportAppDialog.vue
+++ b/dashboard/pkg/epinio/dialog/ExportAppDialog.vue
@@ -32,7 +32,9 @@ const genericPrompt = ref<HTMLElement>(null);
 const partsWeight = {
   [APPLICATION_PARTS.VALUES]: 0.1,
   [APPLICATION_PARTS.CHART]:  0.1,
-  [APPLICATION_PARTS.IMAGE]:  0.7
+  [APPLICATION_PARTS.IMAGE]:  0.7,
+  zip:                         0.1,
+  archive:                     1
 };
 
 const zipParts = props.resources[0]?.applicationParts.filter(
@@ -78,10 +80,16 @@ const exportApplicationManifest = async () => {
       zip.file(`${ fileName }.${ extension[fileName] }`, files[fileName]);
     }
 
-    const contents = await zip.generateAsync({
-      type: 'blob',
-      compression: 'STORE',
-    });
+    percentages.value.zip = 0;
+    const contents = await zip.generateAsync(
+      {
+        type: 'blob',
+        compression: 'STORE',
+      },
+      (metadata) => {
+        percentages.value.zip = metadata.percent;
+      }
+    );
 
     await downloadFile(
       `${ resource.meta.name }-helm-chart.zip`,
@@ -93,6 +101,20 @@ const exportApplicationManifest = async () => {
   if (store.$router.currentRoute._value.hash === '#manifest') {
     await resource.createManifest();
   } else {
+    // Prefer server-side archive (one download, no client zip) when backend supports it
+    const archiveBlob = await fetchPartArchive(resource);
+    if (archiveBlob) {
+      await downloadFile(
+        `${ resource.meta.name }-helm-chart.zip`,
+        archiveBlob,
+        'application/zip',
+      );
+      progressBar.value = 100;
+      await delayBeforeClose(1500);
+      return;
+    }
+
+    // Fallback: fetch three parts and zip in browser (slower, especially in Rancher extension)
     const partsData = await zipParts.reduce(async(acc, part) => ({
       ...await acc,
       [part]: await fetchPart(resource, part),
@@ -121,6 +143,30 @@ const getCancelToken = () => {
   return store.$axios.CancelToken;
 }
 
+// Fetches server-side archive (one zip). Returns blob or null if backend does not support it.
+const fetchPartArchive = async (resource) => {
+  toggleStep('archive', true);
+  cancelTokenSources.archive = getCancelToken().source();
+  try {
+    const blob = await resource.fetchPart('archive', {
+      onDownloadProgress: (progressEvent) => {
+        const total = progressEvent.event?.srcElement?.getResponseHeader?.('content-length') ||
+          progressEvent.event?.srcElement?.getResponseHeader?.('proxy-content-length');
+        if (total) {
+          percentages.value.archive = Math.round(progressEvent.loaded * 100 / total);
+        }
+        if (progressEvent.loaded > 0) {
+          toggleStep('archive');
+        }
+      },
+      cancelToken: cancelTokenSources.archive?.token,
+    });
+    return blob;
+  } catch (e) {
+    return null;
+  }
+};
+
 const fetchPart = async (resource, part) => {
   toggleStep(part, true);
   cancelTokenSources[part] = getCancelToken().source();
@@ -159,8 +205,7 @@ const fetchPart = async (resource, part) => {
 const fetchCancel = () => {
   // Cancel pending api requests, see https://axios-http.com/docs/cancellation
   Object.keys(cancelTokenSources).forEach(
-    (part) => cancelTokenSources[part].
-      cancel(`${ part } part: download cancelled.`)
+    (part) => cancelTokenSources[part]?.cancel?.(`${ part } part: download cancelled.`)
   );
 }
 
@@ -252,7 +297,12 @@ const toggleStep = (part, isPreparing = false) => {
             class="progress-info text info mb-10 mt-20"
           >
             <span v-if="step">
-              {{ t(`epinio.applications.export.chartValuesImages.steps.${ step }`) }}
+              {{ step === 'zip' && typeof percentages.zip === 'number'
+                ? t('epinio.applications.export.chartValuesImages.steps.zip') + ` (${ Math.round(percentages.zip) }%)`
+                : step === 'download.archive' || step === 'preparing.archive'
+                  ? t(`epinio.applications.export.chartValuesImages.steps.${ step }`) + (typeof percentages.archive === 'number' ? ` (${ Math.round(percentages.archive) }%)` : '')
+                  : t(`epinio.applications.export.chartValuesImages.steps.${ step }`)
+              }}
             </span>
             <PercentageBar
               class="progress-bar"

From b40bb0701162d5395c9d8838f9be25ffb1616c48 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Thu, 5 Feb 2026 01:52:51 -0500
Subject: [PATCH 04/36] Update en-us.yaml

---
 dashboard/pkg/epinio/l10n/en-us.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dashboard/pkg/epinio/l10n/en-us.yaml b/dashboard/pkg/epinio/l10n/en-us.yaml
index 9f23fb68..f2547fff 100644
--- a/dashboard/pkg/epinio/l10n/en-us.yaml
+++ b/dashboard/pkg/epinio/l10n/en-us.yaml
@@ -195,10 +195,12 @@ epinio:
             values: "Preparing download: Values"
             chart: "Preparing download: Chart"
             image: "Preparing download: Image"
+            archive: "Preparing download: Chart and Images"
           download:
             values: "Downloading: Values"
             chart: "Downloading: Chart"
             image: "Downloading: Image"
+            archive: "Downloading: Chart and Images"
             zip:   Compressing Files
         error: Server Error, download of { part } part failed.
     steps:

From fdd2398bb08c9d4548169d36425ed7460bb0a316 Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Tue, 10 Feb 2026 13:13:55 -0500
Subject: [PATCH 05/36] change debounce from 1 to 2

---
 dashboard/pkg/epinio/detail/applications.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboard/pkg/epinio/detail/applications.vue b/dashboard/pkg/epinio/detail/applications.vue
index 535a33f5..90db09fe 100644
--- a/dashboard/pkg/epinio/detail/applications.vue
+++ b/dashboard/pkg/epinio/detail/applications.vue
@@ -126,7 +126,7 @@ const commitActions = [{
 }];
 
 // Debounce settings for scaling instances
-const UPDATE_INSTANCES_DEBOUNCE_MS = 1000; // 1s; adjust as needed
+const UPDATE_INSTANCES_DEBOUNCE_MS = 2000; // 2s; adjust as needed
 let updateInstancesTimeout: number | null = null;
 
 onMounted(async () => {

From 60e604bd1e1ea53038df81bc939bd1d8a2e65007 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Wed, 11 Feb 2026 03:28:39 -0500
Subject: [PATCH 06/36] Add RBAC permissions and enforce UI actions

Introduce client-side RBAC support and apply it across the Epinio dashboard. Add utils/permissions.ts to build a flat permission map from /api/v1/me roles, and new EpinioMe/EpinioRole types. Extend the epinio store with a me action, permissions state, a can getter helper, and related mutations/reset. Fetch /me on relevant pages (namespaces, applications) and conditionally show Create buttons only when appropriate permissions are present (with sensible defaults while permissions are not yet loaded). Update resource models (applications, namespaces, services, configurations) to filter available actions based on the can getter and prune orphaned dividers for application actions. Overall this enforces UI-level RBAC while still relying on the API for authoritative enforcement.
---
 dashboard/pkg/epinio/list/namespaces.vue      |  14 +-
 dashboard/pkg/epinio/models/applications.js   |  85 +++++++++++-
 dashboard/pkg/epinio/models/configurations.js |  20 ++-
 dashboard/pkg/epinio/models/namespaces.js     |  25 ++++
 dashboard/pkg/epinio/models/services.js       |  25 ++++
 .../pages/c/_cluster/applications/index.vue   |  20 +++
 .../pkg/epinio/store/epinio-store/actions.ts  |  15 +-
 .../pkg/epinio/store/epinio-store/getters.ts  |  11 ++
 .../epinio/store/epinio-store/mutations.ts    |  18 ++-
 dashboard/pkg/epinio/types.ts                 |  15 ++
 dashboard/pkg/epinio/utils/permissions.ts     | 130 ++++++++++++++++++
 11 files changed, 370 insertions(+), 8 deletions(-)
 create mode 100644 dashboard/pkg/epinio/utils/permissions.ts

diff --git a/dashboard/pkg/epinio/list/namespaces.vue b/dashboard/pkg/epinio/list/namespaces.vue
index 4cd71b96..f66e04dd 100644
--- a/dashboard/pkg/epinio/list/namespaces.vue
+++ b/dashboard/pkg/epinio/list/namespaces.vue
@@ -38,6 +38,16 @@ const showPromptRemove = computed(() => {
   return store.state['action-menu'].showPromptRemove
 });
 
+const canCreateNamespace = computed(() => {
+  const can = store.getters['epinio/can'];
+
+  if (!can) {
+    return false;
+  }
+
+  return can('namespace_write') || can('namespace');
+});
+
 const validationPassed = computed(() => {
   // Add here fields that need validation
   if (!creatingNamespace.value) {
@@ -48,7 +58,8 @@ const validationPassed = computed(() => {
   return errors.value?.length === 0;
 });
 
-onMounted(() => {
+onMounted(async() => {
+  await store.dispatch('epinio/me');
   // Opens the create namespace modal if the query is passed as query param
   if (store.$router.currentRoute._value.query.mode === 'openModal') {
     openCreateModal();
@@ -174,6 +185,7 @@ const columns: DataTableColumn[] = [
     >
       <template #createButton>
         <button
+          v-if="canCreateNamespace"
           class="btn role-primary"
           @click="openCreateModal"
         >
diff --git a/dashboard/pkg/epinio/models/applications.js b/dashboard/pkg/epinio/models/applications.js
index 944b0503..1d67dea9 100644
--- a/dashboard/pkg/epinio/models/applications.js
+++ b/dashboard/pkg/epinio/models/applications.js
@@ -48,6 +48,50 @@ export default class EpinioApplicationModel extends EpinioNamespacedResource {
   // ------------------------------------------------------------------
   // Dashboard plumbing
 
+  get _availableActions() {
+    const base = super._availableActions || [];
+
+    const canGetter = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+
+    // When permissions haven't loaded, show all actions — API enforces RBAC
+    if (!canGetter || !perms || Object.keys(perms).length === 0) {
+      return base;
+    }
+
+    const canEdit = canGetter('app_update') || canGetter('app_write') || canGetter('app');
+    const canDelete = canGetter('app_delete') || canGetter('app_write') || canGetter('app');
+    const canViewConfig = canGetter('configuration_read') || canGetter('configuration_write');
+
+    let skipNextDivider = false;
+
+    return base.filter((action) => {
+      if (skipNextDivider && action.divider) {
+        skipNextDivider = false;
+
+        return false;
+      }
+
+      if (action.action === 'showConfiguration') {
+        if (!canViewConfig) {
+          skipNextDivider = true; // base always has a divider after showConfiguration
+
+          return false;
+        }
+      }
+
+      if (action.action === 'goToEdit' || action.action === 'goToViewConfig') {
+        return canEdit || canViewConfig;
+      }
+
+      if (action.action === 'promptRemove') {
+        return canDelete;
+      }
+
+      return true;
+    });
+  }
+
   get details() {
     const res = [];
 
@@ -163,10 +207,47 @@ export default class EpinioApplicationModel extends EpinioNamespacedResource {
     }
 
     res.push(
-      ...super._availableActions
+      ...this._availableActions
     );
 
-    return res;
+    return this._pruneOrphanedDividers(res);
+  }
+
+  _pruneOrphanedDividers(actions) {
+    // Remove disabled items and consecutive dividers (mirrors resource-class availableActions logic)
+    let last = null;
+    let out = actions.filter((item) => {
+      if (item.enabled === false) {
+        return false;
+      }
+
+      const cur = item.divider;
+      const ok = !cur || (cur && !last);
+
+      last = cur;
+
+      return ok;
+    });
+
+    // Remove dividers at the beginning
+    while (out.length && out[0].divider) {
+      out.shift();
+    }
+
+    // Remove dividers at the end
+    while (out.length && out[out.length - 1].divider) {
+      out.pop();
+    }
+
+    // Remove consecutive dividers in the middle
+    for (let i = 1; i < out.length; i++) {
+      if (out[i].divider && out[i - 1].divider) {
+        out.splice(i, 1);
+        i--;
+      }
+    }
+
+    return out;
   }
 
   get links() {
diff --git a/dashboard/pkg/epinio/models/configurations.js b/dashboard/pkg/epinio/models/configurations.js
index fe05ce82..0ff8a83c 100644
--- a/dashboard/pkg/epinio/models/configurations.js
+++ b/dashboard/pkg/epinio/models/configurations.js
@@ -3,11 +3,27 @@ import EpinioNamespacedResource, { bulkRemove } from './epinio-namespaced-resour
 
 export default class EpinioConfigurationModel extends EpinioNamespacedResource {
   get canCustomEdit() {
-    return !this.isServiceRelated;
+    const canGetter = this.$rootGetters?.['epinio/can'];
+
+    if (!canGetter) {
+      return !this.isServiceRelated;
+    }
+
+    const canEdit = canGetter('configuration_write') || canGetter('configuration');
+
+    return !this.isServiceRelated && canEdit;
   }
 
   get _canDelete() {
-    return !this.isServiceRelated && super._canDelete;
+    const canGetter = this.$rootGetters?.['epinio/can'];
+
+    if (!canGetter) {
+      return !this.isServiceRelated && super._canDelete;
+    }
+
+    const canDelete = canGetter('configuration_write') || canGetter('configuration');
+
+    return !this.isServiceRelated && canDelete && super._canDelete;
   }
 
   // ------------------------------------------------------------------
diff --git a/dashboard/pkg/epinio/models/namespaces.js b/dashboard/pkg/epinio/models/namespaces.js
index 66f56ee3..3c61eb95 100644
--- a/dashboard/pkg/epinio/models/namespaces.js
+++ b/dashboard/pkg/epinio/models/namespaces.js
@@ -2,6 +2,31 @@ import { EPINIO_TYPES } from '../types';
 import EpinioMetaResource from './epinio-namespaced-resource';
 
 export default class EpinioNamespace extends EpinioMetaResource {
+  get _availableActions() {
+    const base = super._availableActions || [];
+
+    const canGetter = this.$rootGetters?.['epinio/can'];
+
+    if (!canGetter) {
+      return base;
+    }
+
+    const canEdit = canGetter('namespace_write') || canGetter('namespace');
+    const canDelete = canGetter('namespace_write') || canGetter('namespace');
+
+    return base.filter((action) => {
+      if (action.action === 'goToEdit') {
+        return canEdit;
+      }
+
+      if (action.action === 'promptRemove') {
+        return canDelete;
+      }
+
+      return true;
+    });
+  }
+
   get links() {
     return {
       self:   this.getUrl(),
diff --git a/dashboard/pkg/epinio/models/services.js b/dashboard/pkg/epinio/models/services.js
index c922a111..37922fae 100644
--- a/dashboard/pkg/epinio/models/services.js
+++ b/dashboard/pkg/epinio/models/services.js
@@ -3,6 +3,31 @@ import { EPINIO_TYPES } from '../types';
 import EpinioNamespacedResource, { bulkRemove } from './epinio-namespaced-resource';
 
 export default class EpinioServiceModel extends EpinioNamespacedResource {
+  get _availableActions() {
+    const base = super._availableActions || [];
+
+    const canGetter = this.$rootGetters?.['epinio/can'];
+
+    if (!canGetter) {
+      return base;
+    }
+
+    const canEdit = canGetter('service_write') || canGetter('service');
+    const canDelete = canGetter('service_write') || canGetter('service');
+
+    return base.filter((action) => {
+      if (action.action === 'goToEdit') {
+        return canEdit;
+      }
+
+      if (action.action === 'promptRemove') {
+        return canDelete;
+      }
+
+      return true;
+    });
+  }
+
   get links() {
     return {
       update: this.getUrl(),
diff --git a/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue b/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue
index abaa0e0f..a7bce3ef 100644
--- a/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue
+++ b/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue
@@ -28,6 +28,24 @@ const openCreateRoute = () => {
   store.$router.push(createLocation.value);
 };
 
+const canCreateApp = computed(() => {
+  const can = store.getters['epinio/can'];
+  const perms = store.getters['epinio/permissions']?.();
+
+  // When permissions haven't loaded yet (me not fetched) or store unavailable,
+  // default to showing Create — API will enforce RBAC. Avoids hiding for users
+  // who have permission when /me has not completed or returns unexpected data.
+  if (!can) {
+    return true;
+  }
+  if (!perms || Object.keys(perms).length === 0) {
+    return true;
+  }
+
+  // Any of these actions implies the ability to create an app
+  return can('app_create') || can('app_write') || can('app');
+});
+
 const rows = computed(() => store.getters['epinio/all'](resource));
 
 // Group applications by namespace
@@ -102,6 +120,7 @@ const columns: DataTableColumn[] = [
 ];
 
 onMounted(async () => {
+  await store.dispatch('epinio/me');
   await store.dispatch('epinio/findAll', { type: EPINIO_TYPES.APP });
   // Non-blocking fetch
   store.dispatch('epinio/findAll', { type: EPINIO_TYPES.CONFIGURATION });
@@ -140,6 +159,7 @@ onUnmounted(() => {
     >
       <template #createButton>
         <button
+          v-if="canCreateApp"
           class="btn role-primary"
           @click="openCreateRoute"
         >
diff --git a/dashboard/pkg/epinio/store/epinio-store/actions.ts b/dashboard/pkg/epinio/store/epinio-store/actions.ts
index 52404d1b..a604d207 100644
--- a/dashboard/pkg/epinio/store/epinio-store/actions.ts
+++ b/dashboard/pkg/epinio/store/epinio-store/actions.ts
@@ -13,11 +13,13 @@ import {
   EPINIO_MGMT_STORE,
   EPINIO_PRODUCT_NAME,
   EPINIO_STANDALONE_CLUSTER_NAME,
-  EPINIO_TYPES
+  EPINIO_TYPES,
+  type EpinioMe
 } from '../../types';
 import EpinioCluster from '../../models/epiniomgmt/epinio.io.management.cluster';
 import { RedirectToError } from '@shell/utils/error';
 import { allHashSettled } from '@shell/utils/promise';
+import { buildPermissionsFromRoles } from '../../utils/permissions';
 
 const createId = (schema: any, resource: any) => {
   const name = resource.meta?.name || resource.name;
@@ -363,4 +365,15 @@ export default {
     return info;
   },
 
+  me: async( { dispatch, commit }: any ): Promise<EpinioMe> => {
+    // Always fetch fresh so permissions reflect the current user (no stale cache after login switch)
+    const me = await dispatch('request', { opt: { url: `/api/v1/me` } });
+    const permissions = buildPermissionsFromRoles(me.roles || []);
+
+    commit('me', me);
+    commit('permissions', permissions);
+
+    return me;
+  },
+
 };
diff --git a/dashboard/pkg/epinio/store/epinio-store/getters.ts b/dashboard/pkg/epinio/store/epinio-store/getters.ts
index ad600ce5..5ce1bd5d 100644
--- a/dashboard/pkg/epinio/store/epinio-store/getters.ts
+++ b/dashboard/pkg/epinio/store/epinio-store/getters.ts
@@ -66,4 +66,15 @@ export default {
   info: (state: any) => () => state.info,
 
   version: (state: any) => () => state.version,
+
+  me: (state: any) => () => state.me,
+
+  permissions: (state: any) => () => state.permissions,
+
+  // Convenience helper: check if the current user has a given action permission
+  can: (state: any, getters: any) => (actionId: string): boolean => {
+    const perms = getters.permissions?.() || {};
+
+    return !!perms[actionId];
+  },
 };
diff --git a/dashboard/pkg/epinio/store/epinio-store/mutations.ts b/dashboard/pkg/epinio/store/epinio-store/mutations.ts
index b1870997..3c8462ee 100644
--- a/dashboard/pkg/epinio/store/epinio-store/mutations.ts
+++ b/dashboard/pkg/epinio/store/epinio-store/mutations.ts
@@ -1,4 +1,5 @@
-import { EpinioInfo, EpinioVersion } from '../../types';
+import type { EpinioInfo, EpinioVersion, EpinioMe } from '../../types';
+import type { EpinioPermissions } from '../../utils/permissions';
 
 export default {
 
@@ -12,5 +13,18 @@ export default {
 
   version(state: any, version: EpinioVersion) {
     state.version = version;
-  }
+  },
+
+  me(state: any, me: EpinioMe) {
+    state.me = me;
+  },
+
+  permissions(state: any, permissions: EpinioPermissions) {
+    state.permissions = permissions;
+  },
+
+  reset(state: any) {
+    state.me = undefined;
+    state.permissions = undefined;
+  },
 };
diff --git a/dashboard/pkg/epinio/types.ts b/dashboard/pkg/epinio/types.ts
index 0f100214..57bc8c30 100644
--- a/dashboard/pkg/epinio/types.ts
+++ b/dashboard/pkg/epinio/types.ts
@@ -234,6 +234,21 @@ export interface EpinioVersion {
   displayVersion: string,
 }
 
+// Mirrors pkg/api/core/v1/models.MeResponse / Role (simplified)
+export interface EpinioRole {
+  id: string,
+  name: string,
+  namespace?: string,
+  default?: boolean,
+}
+
+export interface EpinioMe {
+  user: string,
+  roles: EpinioRole[],
+  namespaces: string[],
+  gitconfigs: string[],
+}
+
 export interface EpinioNamespace extends EpinioMetaProperty {
   apps: string[],
   configurations: string[],
diff --git a/dashboard/pkg/epinio/utils/permissions.ts b/dashboard/pkg/epinio/utils/permissions.ts
new file mode 100644
index 00000000..5ca6a9c9
--- /dev/null
+++ b/dashboard/pkg/epinio/utils/permissions.ts
@@ -0,0 +1,130 @@
+import type { EpinioRole } from '../types';
+
+// Mapping from Epinio role IDs to the action IDs they imply.
+// These should stay in sync with the server-side role definitions.
+const ROLE_ACTIONS: Record<string, string[]> = {
+  // Read-only role
+  view_only: [
+    'namespace_read',
+    'app_read',
+    'app_logs',
+    'configuration_read',
+    'service_read',
+    'gitconfig_read',
+    'export_registries_read',
+  ],
+
+  // Application Developer: create/update applications but no delete or non-app writes
+  application_developer: [
+    'namespace_read',
+    'app_read',
+    'app_logs',
+    'app_create',
+    'app_update',
+    'app_scale',
+    'app_update_env',
+    'app_update_configs',
+    'app_update_routes',
+    'app_update_settings',
+    'app_update_chart',
+    'app_stage',
+    'app_deploy',
+    'app_export',
+  ],
+
+  // Application Manager: full app CRUD and runtime operations, no non-app writes
+  application_manager: [
+    'namespace_read',
+    'app_read',
+    'app_logs',
+    'app_create',
+    'app_update',
+    'app_scale',
+    'app_update_env',
+    'app_update_configs',
+    'app_update_routes',
+    'app_update_settings',
+    'app_update_chart',
+    'app_stage',
+    'app_deploy',
+    'app_export',
+    'app_delete',
+    'app_restart',
+    'app_exec',
+    'app_portforward',
+  ],
+
+  // System Manager: no-delete role, app create/update/runtime plus read-only on other resources
+  system_manager: [
+    'namespace_read',
+    'app_read',
+    'app_logs',
+    'app_create',
+    'app_update',
+    'app_scale',
+    'app_update_env',
+    'app_update_configs',
+    'app_update_routes',
+    'app_update_settings',
+    'app_update_chart',
+    'app_stage',
+    'app_deploy',
+    'app_export',
+    'app_restart',
+    'app_exec',
+    'app_portforward',
+    'configuration_read',
+    'service_read',
+    'gitconfig_read',
+    'export_registries_read',
+  ],
+};
+
+// Union of all actions for the admin role – effectively "everything".
+const ADMIN_ACTIONS = Array.from(
+  new Set<string>(Object.values(ROLE_ACTIONS).flat()),
+);
+
+export type EpinioPermissions = Record<string, boolean>;
+
+/**
+ * Normalize role ID so both "application_developer" and "epinio-role-application-developer" map correctly.
+ * ConfigMaps may use id equal to the short name or the full ConfigMap name.
+ */
+function normalizeRoleId(id: string): string {
+  if (!id) return id;
+  // epinio-role-application-developer -> application_developer
+  if (id.startsWith('epinio-role-')) {
+    return id.slice('epinio-role-'.length).replace(/-/g, '_');
+  }
+  return id;
+}
+
+/**
+ * Build a flat permission map from the list of roles returned by /api/v1/me.
+ * Keys are action IDs (e.g. "app_create", "namespace_write"), values are booleans.
+ */
+export function buildPermissionsFromRoles(roles: EpinioRole[]): EpinioPermissions {
+  const actions = new Set<string>();
+
+  for (const role of roles || []) {
+    const roleId = normalizeRoleId(role.id || '');
+
+    if (roleId === 'admin') {
+      ADMIN_ACTIONS.forEach((a) => actions.add(a));
+      continue;
+    }
+
+    const mapped = ROLE_ACTIONS[roleId] || [];
+    mapped.forEach((a) => actions.add(a));
+  }
+
+  const perms: EpinioPermissions = {};
+
+  actions.forEach((a) => {
+    perms[a] = true;
+  });
+
+  return perms;
+}
+

From 5bb0c49494925324ed271514d3c5e458209a5314 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Wed, 11 Feb 2026 05:19:33 -0500
Subject: [PATCH 07/36] linting error esolved

---
 dashboard/{eslint.config.js => eslint.config.mjs} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename dashboard/{eslint.config.js => eslint.config.mjs} (100%)

diff --git a/dashboard/eslint.config.js b/dashboard/eslint.config.mjs
similarity index 100%
rename from dashboard/eslint.config.js
rename to dashboard/eslint.config.mjs

From b434714775b322423281e036246f1a32eeace4e0 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Mon, 16 Feb 2026 13:01:01 +0530
Subject: [PATCH 08/36] Update ExportAppDialog.vue

---
 .../pkg/epinio/dialog/ExportAppDialog.vue     | 73 +++----------------
 1 file changed, 10 insertions(+), 63 deletions(-)

diff --git a/dashboard/pkg/epinio/dialog/ExportAppDialog.vue b/dashboard/pkg/epinio/dialog/ExportAppDialog.vue
index 9a34d2cd..83a4dbe0 100644
--- a/dashboard/pkg/epinio/dialog/ExportAppDialog.vue
+++ b/dashboard/pkg/epinio/dialog/ExportAppDialog.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import { useStore } from 'vuex'
-import {ref, computed, onMounted, onBeforeUnmount } from 'vue';
+import { ref, onMounted, onBeforeUnmount } from 'vue';
 
 import JSZip from 'jszip';
 
@@ -10,7 +10,6 @@ import Tab from '@shell/components/Tabbed/Tab.vue';
 import { downloadFile } from '@shell/utils/download';
 import GenericPrompt from '@shell/dialog/GenericPrompt';
 import Tabbed from '@shell/components/Tabbed/index.vue';
-import PercentageBar from '@shell/components/PercentageBar';
 
 const store = useStore();
 const t = store.getters['i18n/t'];
@@ -23,20 +22,10 @@ const props = defineProps<{
 }>();
 
 const showProgressBar = ref<boolean>(false);
-const percentages = ref<object>({});
 const step = ref<any>(null);
 const cancelTokenSources:object = {};
-const colorStops:object = { 0: '--primary', 100: '--primary' };
 const genericPrompt = ref<HTMLElement>(null);
 
-const partsWeight = {
-  [APPLICATION_PARTS.VALUES]: 0.1,
-  [APPLICATION_PARTS.CHART]:  0.1,
-  [APPLICATION_PARTS.IMAGE]:  0.7,
-  zip:                         0.1,
-  archive:                     1
-};
-
 const zipParts = props.resources[0]?.applicationParts.filter(
   (part) => part !== APPLICATION_PARTS.MANIFEST
 );
@@ -53,16 +42,6 @@ onBeforeUnmount(() => {
   }, 2000);
 });
 
-const progressBar = computed({
-  get() {
-    return Object.keys(percentages.value).reduce(
-      (acc, part) => acc + (percentages.value[part] * (partsWeight[part] || 1)), 0);
-  },
-  set(value) {
-    percentages.value = { value };
-  }
-}, { immediate: true });
-
 const exportApplicationManifest = async () => {
   enableDownload();
   const resource = props.resources[0];
@@ -80,16 +59,10 @@ const exportApplicationManifest = async () => {
       zip.file(`${ fileName }.${ extension[fileName] }`, files[fileName]);
     }
 
-    percentages.value.zip = 0;
-    const contents = await zip.generateAsync(
-      {
-        type: 'blob',
-        compression: 'STORE',
-      },
-      (metadata) => {
-        percentages.value.zip = metadata.percent;
-      }
-    );
+    const contents = await zip.generateAsync({
+      type: 'blob',
+      compression: 'STORE',
+    });
 
     await downloadFile(
       `${ resource.meta.name }-helm-chart.zip`,
@@ -109,7 +82,6 @@ const exportApplicationManifest = async () => {
         archiveBlob,
         'application/zip',
       );
-      progressBar.value = 100;
       await delayBeforeClose(1500);
       return;
     }
@@ -128,7 +100,6 @@ const exportApplicationManifest = async () => {
 
     await chartZip(partsData);
 
-    progressBar.value = 100;
     await delayBeforeClose(1500);
   }
 }
@@ -150,11 +121,6 @@ const fetchPartArchive = async (resource) => {
   try {
     const blob = await resource.fetchPart('archive', {
       onDownloadProgress: (progressEvent) => {
-        const total = progressEvent.event?.srcElement?.getResponseHeader?.('content-length') ||
-          progressEvent.event?.srcElement?.getResponseHeader?.('proxy-content-length');
-        if (total) {
-          percentages.value.archive = Math.round(progressEvent.loaded * 100 / total);
-        }
         if (progressEvent.loaded > 0) {
           toggleStep('archive');
         }
@@ -174,13 +140,6 @@ const fetchPart = async (resource, part) => {
   return await resource.fetchPart(
     part, {
       onDownloadProgress: (progressEvent) => {
-        const total = progressEvent.event.srcElement.getResponseHeader('content-length') ||
-          progressEvent.event.srcElement.getResponseHeader('proxy-content-length');
-
-        if (total) {
-          percentages.value[part] = Math.round(progressEvent.loaded * 100 / total);
-        }
-
         if (progressEvent.loaded > 0) {
           toggleStep(part);
         }
@@ -237,7 +196,6 @@ const enableDownload = () => {
 const disableDownload = () => {
   fetchCancel();
   showProgressBar.value = false;
-  progressBar.value = 0;
   toggleStep(null);
 }
 
@@ -296,20 +254,10 @@ const toggleStep = (part, isPreparing = false) => {
             v-if="showProgressBar"
             class="progress-info text info mb-10 mt-20"
           >
+            <i class="icon-spinner animate-spin mr-5" />
             <span v-if="step">
-              {{ step === 'zip' && typeof percentages.zip === 'number'
-                ? t('epinio.applications.export.chartValuesImages.steps.zip') + ` (${ Math.round(percentages.zip) }%)`
-                : step === 'download.archive' || step === 'preparing.archive'
-                  ? t(`epinio.applications.export.chartValuesImages.steps.${ step }`) + (typeof percentages.archive === 'number' ? ` (${ Math.round(percentages.archive) }%)` : '')
-                  : t(`epinio.applications.export.chartValuesImages.steps.${ step }`)
-              }}
+              {{ t(`epinio.applications.export.chartValuesImages.steps.${ step }`) }}
             </span>
-            <PercentageBar
-              class="progress-bar"
-              :modelValue="progressBar"
-              :color-stops="colorStops"
-              preferred-direction="MORE"
-            />
           </div>
         </Tab>
       </Tabbed>
@@ -327,9 +275,8 @@ const toggleStep = (part, isPreparing = false) => {
 }
 
 .progress-info {
-  span {
-    display: block;
-    margin-bottom: 10px;
-  }
+  display: flex;
+  align-items: center;
+  gap: 8px;
 }
 </style>

From 32e66ccf0b9d6990e3bc5ab60ad2432f4a977167 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Mon, 16 Feb 2026 13:14:08 +0530
Subject: [PATCH 09/36] L:int error

---
 dashboard/pkg/epinio/dialog/ExportAppDialog.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboard/pkg/epinio/dialog/ExportAppDialog.vue b/dashboard/pkg/epinio/dialog/ExportAppDialog.vue
index 83a4dbe0..7fc55cd9 100644
--- a/dashboard/pkg/epinio/dialog/ExportAppDialog.vue
+++ b/dashboard/pkg/epinio/dialog/ExportAppDialog.vue
@@ -128,7 +128,7 @@ const fetchPartArchive = async (resource) => {
       cancelToken: cancelTokenSources.archive?.token,
     });
     return blob;
-  } catch (e) {
+  } catch {
     return null;
   }
 };

From 50491a6757a67a51caa1d99c7e56b8d0fb212924 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 26 Feb 2026 10:08:03 +0000
Subject: [PATCH 10/36] chore(deps): bump anchore/sbom-action from 0.21.1 to
 0.23.0

Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.21.1 to 0.23.0.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](https://github.com/anchore/sbom-action/compare/v0.21.1...v0.23.0)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/release-next.yml | 2 +-
 .github/workflows/release.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release-next.yml b/.github/workflows/release-next.yml
index 7a9c648b..42104373 100644
--- a/.github/workflows/release-next.yml
+++ b/.github/workflows/release-next.yml
@@ -38,7 +38,7 @@ jobs:
         name: Install yarn
         run: npm install  --global yarn
       -
-        uses: anchore/sbom-action/download-syft@v0.21.1
+        uses: anchore/sbom-action/download-syft@v0.23.0
       -
         uses: sigstore/cosign-installer@v4.0.0
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9132ae97..59340ddc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,7 @@ jobs:
         name: Install yarn
         run: npm install  --global yarn
       -
-        uses: anchore/sbom-action/download-syft@v0.21.1
+        uses: anchore/sbom-action/download-syft@v0.23.0
       -
         uses: sigstore/cosign-installer@v4.0.0
         with:

From fa5dd4172ac820379882dfc25f72a4d3118721eb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 27 Feb 2026 10:07:26 +0000
Subject: [PATCH 11/36] chore(deps): bump actions/upload-artifact from 6 to 7

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/dashboard-build-extension.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dashboard-build-extension.yml b/.github/workflows/dashboard-build-extension.yml
index f53d29c1..5d88aa8b 100644
--- a/.github/workflows/dashboard-build-extension.yml
+++ b/.github/workflows/dashboard-build-extension.yml
@@ -105,7 +105,7 @@ jobs:
 
       - name: Upload charts artifact
         if: github.ref_type == 'tag' || (github.ref == 'refs/heads/main' && github.event_name != 'pull_request') || inputs.is_test == 'true'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: charts
           path: ./dashboard/tmp

From ce3a3af80bb985c9870228df91f32e7b42cb98be Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 27 Feb 2026 10:07:29 +0000
Subject: [PATCH 12/36] chore(deps): bump actions/download-artifact from 7 to 8

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v7...v8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/dashboard-build-extension.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dashboard-build-extension.yml b/.github/workflows/dashboard-build-extension.yml
index f53d29c1..f031ecdf 100644
--- a/.github/workflows/dashboard-build-extension.yml
+++ b/.github/workflows/dashboard-build-extension.yml
@@ -134,7 +134,7 @@ jobs:
           git config user.email 'github-actions[bot]@users.noreply.github.com'
 
       - name: Download build artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: charts
           path: ./dashboard

From 737f129846301866b5c65bf82c2976fabe276072 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Thu, 5 Mar 2026 10:09:40 +0530
Subject: [PATCH 13/36] Edit config button visibility corrected

---
 dashboard/pkg/epinio/list/configurations.vue  |  1 +
 dashboard/pkg/epinio/models/configurations.js | 45 +++++++++++++++----
 2 files changed, 38 insertions(+), 8 deletions(-)

diff --git a/dashboard/pkg/epinio/list/configurations.vue b/dashboard/pkg/epinio/list/configurations.vue
index 1a1c57a5..94947900 100644
--- a/dashboard/pkg/epinio/list/configurations.vue
+++ b/dashboard/pkg/epinio/list/configurations.vue
@@ -16,6 +16,7 @@ defineProps<{ schema: object }>(); // Keep for compatibility
 const pending = ref<boolean>(true);
 
 onMounted(async () => {
+  await store.dispatch('epinio/me');
   store.dispatch(`epinio/findAll`, { type: EPINIO_TYPES.APP });
   store.dispatch(`epinio/findAll`, { type: EPINIO_TYPES.SERVICE_INSTANCE });
   await store.dispatch(`epinio/findAll`, { type: EPINIO_TYPES.CONFIGURATION });
diff --git a/dashboard/pkg/epinio/models/configurations.js b/dashboard/pkg/epinio/models/configurations.js
index 0ff8a83c..a1d806cf 100644
--- a/dashboard/pkg/epinio/models/configurations.js
+++ b/dashboard/pkg/epinio/models/configurations.js
@@ -2,26 +2,55 @@ import { EPINIO_TYPES } from '../types';
 import EpinioNamespacedResource, { bulkRemove } from './epinio-namespaced-resource';
 
 export default class EpinioConfigurationModel extends EpinioNamespacedResource {
+  get _availableActions() {
+    const base = super._availableActions || [];
+    const can = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+
+    // Same pattern as Create application: when permissions haven't loaded, show all actions
+    if (!can || !perms || Object.keys(perms).length === 0) {
+      return base;
+    }
+
+    const canEdit = can('configuration_write') || can('configuration');
+    const canDelete = can('configuration_write') || can('configuration');
+
+    return base.filter((action) => {
+      if (action.action === 'goToEdit') {
+        return canEdit;
+      }
+      if (action.action === 'promptRemove') {
+        return canDelete;
+      }
+      return true;
+    });
+  }
+
   get canCustomEdit() {
-    const canGetter = this.$rootGetters?.['epinio/can'];
+    const can = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
 
-    if (!canGetter) {
+    // Same pattern as Create application: when permissions haven't loaded yet (me not fetched)
+    // or store unavailable, default to showing Edit — API will enforce RBAC.
+    if (!can) {
+      return !this.isServiceRelated;
+    }
+    if (!perms || Object.keys(perms).length === 0) {
       return !this.isServiceRelated;
     }
 
-    const canEdit = canGetter('configuration_write') || canGetter('configuration');
-
-    return !this.isServiceRelated && canEdit;
+    return !this.isServiceRelated && (can('configuration_write') || can('configuration'));
   }
 
   get _canDelete() {
-    const canGetter = this.$rootGetters?.['epinio/can'];
+    const can = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
 
-    if (!canGetter) {
+    if (!can || !perms || Object.keys(perms).length === 0) {
       return !this.isServiceRelated && super._canDelete;
     }
 
-    const canDelete = canGetter('configuration_write') || canGetter('configuration');
+    const canDelete = can('configuration_write') || can('configuration');
 
     return !this.isServiceRelated && canDelete && super._canDelete;
   }

From 301e0c4c6b6dda527a082ecb441158857d1e80aa Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 5 Mar 2026 10:08:21 +0000
Subject: [PATCH 14/36] chore(deps): bump docker/setup-buildx-action from 3 to
 4

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3 to 4.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/release-next.yml | 2 +-
 .github/workflows/release.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release-next.yml b/.github/workflows/release-next.yml
index 7a9c648b..546c9329 100644
--- a/.github/workflows/release-next.yml
+++ b/.github/workflows/release-next.yml
@@ -45,7 +45,7 @@ jobs:
           cosign-release: 'v2.5.1'
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       -
         name: Login to GitHub Docker Registry
         uses: docker/login-action@v3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9132ae97..7d3bbd69 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
           cosign-release: 'v2.5.1'
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       -
         name: Login to GitHub Docker Registry
         uses: docker/login-action@v3

From 81acc83dc8a1a516a4e843513ca25bb5267c8239 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Thu, 5 Mar 2026 17:37:46 +0530
Subject: [PATCH 15/36] Create instance button hidden from read only user

---
 dashboard/pkg/epinio/config/epinio.ts   |  1 +
 dashboard/pkg/epinio/list/services.vue  | 44 +++++++++++++++++++++++--
 dashboard/pkg/epinio/models/services.js | 12 +++----
 3 files changed, 48 insertions(+), 9 deletions(-)

diff --git a/dashboard/pkg/epinio/config/epinio.ts b/dashboard/pkg/epinio/config/epinio.ts
index b79eb840..7211df11 100644
--- a/dashboard/pkg/epinio/config/epinio.ts
+++ b/dashboard/pkg/epinio/config/epinio.ts
@@ -160,6 +160,7 @@ export function init($plugin: any, store: any) {
     showState:   true,
     canYaml:     false,
     customRoute: createEpinioRoute('c-cluster-resource', { resource: EPINIO_TYPES.SERVICE_INSTANCE }),
+    showListMasthead: false, // Custom masthead with RBAC-gated Create button
   });
 
   // Catalog Service
diff --git a/dashboard/pkg/epinio/list/services.vue b/dashboard/pkg/epinio/list/services.vue
index 640c2745..4997751d 100644
--- a/dashboard/pkg/epinio/list/services.vue
+++ b/dashboard/pkg/epinio/list/services.vue
@@ -2,17 +2,45 @@
 import { ref, onMounted, onUnmounted, computed } from 'vue';
 
 import { EPINIO_TYPES } from '../types';
+import { createEpinioRoute } from '../utils/custom-routing';
 import DataTable from '../components/tables/DataTable.vue';
 import type { DataTableColumn } from '../components/tables/types';
 import LinkDetail from '@shell/components/formatter/LinkDetail.vue';
 import BadgeStateFormatter from '@shell/components/formatter/BadgeStateFormatter.vue';
+import Masthead from '@shell/components/ResourceList/Masthead';
 import { useStore } from 'vuex';
 import { startPolling, stopPolling } from '../utils/polling';
 
 const pending = ref(true);
 const store = useStore();
+const t = store.getters['i18n/t'];
+
+const schema = ref(store.getters['epinio/schemaFor'](EPINIO_TYPES.SERVICE_INSTANCE));
+const resource = EPINIO_TYPES.SERVICE_INSTANCE;
+
+const createLocation = computed(() =>
+  createEpinioRoute('c-cluster-resource-create', {
+    cluster: store.getters['clusterId'],
+    resource: EPINIO_TYPES.SERVICE_INSTANCE,
+  })
+);
+
+const canCreateService = computed(() => {
+  const can = store.getters['epinio/can'];
+  const perms = store.getters['epinio/permissions']?.();
+
+  if (!can) {
+    return true;
+  }
+  if (!perms || Object.keys(perms).length === 0) {
+    return true;
+  }
+
+  return can('service_write') || can('service');
+});
 
 onMounted(async () => {
+  await store.dispatch('epinio/me');
   await Promise.all([
     store.dispatch(`epinio/findAll`, { type: EPINIO_TYPES.APP }),
     store.dispatch(
@@ -22,8 +50,6 @@ onMounted(async () => {
   ]);
   pending.value = false;
 
-  // Catalog services are static - only poll on initial load, not continuously
-  // They're loaded above but don't need frequent updates
   startPolling(["namespaces", "applications", "services"], store);
 });
 
@@ -67,6 +93,20 @@ const columns: DataTableColumn[] = [
 ];
 </script>
 <template>
+  <Masthead
+    :schema="schema"
+    :resource="resource"
+  >
+    <template #createButton>
+      <button
+        v-if="canCreateService"
+        class="btn role-primary"
+        @click="store.$router.push(createLocation)"
+      >
+        {{ t('generic.create') }}
+      </button>
+    </template>
+  </Masthead>
   <DataTable
     :rows="rows"
     :columns="columns"
diff --git a/dashboard/pkg/epinio/models/services.js b/dashboard/pkg/epinio/models/services.js
index 37922fae..a47e7531 100644
--- a/dashboard/pkg/epinio/models/services.js
+++ b/dashboard/pkg/epinio/models/services.js
@@ -5,25 +5,23 @@ import EpinioNamespacedResource, { bulkRemove } from './epinio-namespaced-resour
 export default class EpinioServiceModel extends EpinioNamespacedResource {
   get _availableActions() {
     const base = super._availableActions || [];
+    const can = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
 
-    const canGetter = this.$rootGetters?.['epinio/can'];
-
-    if (!canGetter) {
+    if (!can || !perms || Object.keys(perms).length === 0) {
       return base;
     }
 
-    const canEdit = canGetter('service_write') || canGetter('service');
-    const canDelete = canGetter('service_write') || canGetter('service');
+    const canEdit = can('service_write') || can('service');
+    const canDelete = can('service_write') || can('service');
 
     return base.filter((action) => {
       if (action.action === 'goToEdit') {
         return canEdit;
       }
-
       if (action.action === 'promptRemove') {
         return canDelete;
       }
-
       return true;
     });
   }

From 6340446a00f8b7700b70b234a86809e86584abca Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Thu, 5 Mar 2026 16:53:40 -0500
Subject: [PATCH 16/36] chore(Cleanup UI naming):

---
 .../pkg/epinio/components/application/AppInfo.vue      |  1 -
 dashboard/pkg/epinio/l10n/en-us.yaml                   | 10 +++++-----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/dashboard/pkg/epinio/components/application/AppInfo.vue b/dashboard/pkg/epinio/components/application/AppInfo.vue
index e5cb7435..6bed62cd 100644
--- a/dashboard/pkg/epinio/components/application/AppInfo.vue
+++ b/dashboard/pkg/epinio/components/application/AppInfo.vue
@@ -241,7 +241,6 @@ const moveBooleansToFront = (settingsObj: any) => {
   <Loading v-if="!values" />
   <div v-else>
     <div class="col">
-      Test
       <NameNsDescription
         data-testid="epinio_app-info_name-ns"
         :namespaces-override="namespaceNames"
diff --git a/dashboard/pkg/epinio/l10n/en-us.yaml b/dashboard/pkg/epinio/l10n/en-us.yaml
index af25bd08..f25001e7 100644
--- a/dashboard/pkg/epinio/l10n/en-us.yaml
+++ b/dashboard/pkg/epinio/l10n/en-us.yaml
@@ -66,20 +66,20 @@ epinio:
     allPackages: See all packages
     getBinaries: Get binaries
   downloadReport:
-    title: Download report
-    action: Download Report
-    success: Report downloaded successfully
+    title: Cluster Metrics Report
+    action: Download
+    success: Metrics report downloaded successfully
     errors:
       unauthorized: You need admin permissions to download the report
       failed: Failed to download report. Please try again or contact support
   supportBundle:
-    title: Download support bundle
+    title: Download Support Bundle
     description: Collect a troubleshooting bundle for support.
     tail:
       label: Log lines per component
       help: Defaults to 1000 lines. Maximum 10000.
     includeApps: Include application logs
-    action: Download Support Bundle
+    action: Download
     collecting: Collecting logs from Epinio components...
     success: Support bundle downloaded successfully
     errors:

From a7c5d84487623021fce7ac3dc57823db5d6784b3 Mon Sep 17 00:00:00 2001
From: mohit3334 <sanghvipranay17@gmail.com>
Date: Fri, 6 Mar 2026 18:46:35 +0530
Subject: [PATCH 17/36] gate Create/Shell/Config by permissions, fix Vue
 reactive warning

- config: isCreatable false for Configuration/Service; Create only when canCreateConfiguration/canCreateService
- configurations.vue: masthead + RBAC-gated Create button
- services.vue: strict canCreateService (hide when no service_write)
- applications: gate shell by app_exec, Edit/ViewConfig by app_update and configuration_read/write
- permissions: add configuration and service actions to role definitions
- index.ts: markRaw for ThemeToggle and UnsavedChangesDialog (Vue warning fix)
---
 dashboard/pkg/epinio/config/epinio.ts        |  9 +++--
 dashboard/pkg/epinio/index.ts                |  9 +++--
 dashboard/pkg/epinio/list/configurations.vue | 39 ++++++++++++++++++++
 dashboard/pkg/epinio/list/services.vue       |  9 ++---
 dashboard/pkg/epinio/models/applications.js  | 18 +++++++--
 dashboard/pkg/epinio/utils/permissions.ts    |  8 ++++
 6 files changed, 76 insertions(+), 16 deletions(-)

diff --git a/dashboard/pkg/epinio/config/epinio.ts b/dashboard/pkg/epinio/config/epinio.ts
index 7211df11..afc92b09 100644
--- a/dashboard/pkg/epinio/config/epinio.ts
+++ b/dashboard/pkg/epinio/config/epinio.ts
@@ -137,14 +137,15 @@ export function init($plugin: any, store: any) {
     customRoute: createEpinioRoute('c-cluster-resource', { resource: EPINIO_TYPES.APP_CHARTS }),
   });
 
-  // Configuration resource
+  // Configuration resource (isCreatable: false so shell doesn't show Create; list shows it only when canCreateConfiguration)
   configureType(EPINIO_TYPES.CONFIGURATION, {
-    isCreatable: true,
+    isCreatable: false,
     isEditable:  true,
     isRemovable: true,
     showState:   false,
     canYaml:     false,
     customRoute: createEpinioRoute('c-cluster-resource', { resource: EPINIO_TYPES.CONFIGURATION }),
+    showListMasthead: false,
   });
 
   // Groups
@@ -152,9 +153,9 @@ export function init($plugin: any, store: any) {
   const SERVICE_GROUP = 'Services';
   const ABOUT = 'System';
 
-  // Service Instance
+  // Service Instance (isCreatable: false so shell doesn't show Create; our list/services.vue shows it only when canCreateService)
   configureType(EPINIO_TYPES.SERVICE_INSTANCE, {
-    isCreatable: true,
+    isCreatable: false,
     isEditable:  true,
     isRemovable: true,
     showState:   true,
diff --git a/dashboard/pkg/epinio/index.ts b/dashboard/pkg/epinio/index.ts
index 59740b78..0c9af7d4 100644
--- a/dashboard/pkg/epinio/index.ts
+++ b/dashboard/pkg/epinio/index.ts
@@ -1,3 +1,4 @@
+import { markRaw } from 'vue';
 import { importTypes } from '@rancher/auto-import';
 import {
   ActionLocation, ActionOpts, IPlugin, OnNavAwayFromPackage, OnNavToPackage
@@ -61,16 +62,16 @@ export default function(plugin: IPlugin) {
   // Add Vue Routes
   plugin.addRoutes(epinioRoutes);
 
-  // Add theme toggle to header
+  // Add theme toggle to header (markRaw avoids Vue reactive-object warning)
   const ThemeToggle = require('./components/ThemeToggle.vue'); // eslint-disable-line @typescript-eslint/no-require-imports
-  plugin.register('component', 'NavHeaderRight', ThemeToggle.default || ThemeToggle);
+  plugin.register('component', 'NavHeaderRight', markRaw(ThemeToggle.default || ThemeToggle));
 
   // Add hooks to Vue navigation world
   plugin.addNavHooks(onEnter, onLeave);
 
-  // Register unsaved changes dialog
+  // Register unsaved changes dialog (markRaw avoids Vue reactive-object warning)
   const UnsavedChangesDialog = require('./dialog/UnsavedChangesDialog.vue'); // eslint-disable-line @typescript-eslint/no-require-imports
-  plugin.register('component', 'UnsavedChangesDialog', UnsavedChangesDialog.default || UnsavedChangesDialog);
+  plugin.register('component', 'UnsavedChangesDialog', markRaw(UnsavedChangesDialog.default || UnsavedChangesDialog));
 
   // Add action button in the menu of each object belonging to Epinio's applications
   plugin.addAction(
diff --git a/dashboard/pkg/epinio/list/configurations.vue b/dashboard/pkg/epinio/list/configurations.vue
index 94947900..71eeec43 100644
--- a/dashboard/pkg/epinio/list/configurations.vue
+++ b/dashboard/pkg/epinio/list/configurations.vue
@@ -2,17 +2,42 @@
 import DataTable from '../components/tables/DataTable.vue';
 import type { DataTableColumn } from '../components/tables/types';
 import { EPINIO_TYPES } from '../types';
+import { createEpinioRoute } from '../utils/custom-routing';
 import LinkDetail from '@shell/components/formatter/LinkDetail.vue';
 import BadgeStateFormatter from '@shell/components/formatter/BadgeStateFormatter.vue';
+import Masthead from '@shell/components/ResourceList/Masthead';
 
 import { useStore } from 'vuex';
 import { ref, computed, onMounted, onUnmounted } from 'vue';
 import { startPolling, stopPolling } from '../utils/polling';
 
 const store = useStore();
+const t = store.getters['i18n/t'];
 
 defineProps<{ schema: object }>(); // Keep for compatibility
 
+const schema = ref(store.getters['epinio/schemaFor'](EPINIO_TYPES.CONFIGURATION));
+const resource = EPINIO_TYPES.CONFIGURATION;
+
+const createLocation = computed(() =>
+  createEpinioRoute('c-cluster-resource-create', {
+    cluster: store.getters['clusterId'],
+    resource: EPINIO_TYPES.CONFIGURATION,
+  })
+);
+
+// Strict RBAC: only show Create when user has configuration write (hides for view_only)
+const canCreateConfiguration = computed(() => {
+  const can = store.getters['epinio/can'];
+  const perms = store.getters['epinio/permissions']?.();
+
+  if (!can || !perms || Object.keys(perms).length === 0) {
+    return false;
+  }
+
+  return can('configuration_write') || can('configuration');
+});
+
 const pending = ref<boolean>(true);
 
 onMounted(async () => {
@@ -77,6 +102,20 @@ const columns: DataTableColumn[] = [
 </script>
 
 <template>
+  <Masthead
+    :schema="schema"
+    :resource="resource"
+  >
+    <template #createButton>
+      <button
+        v-if="canCreateConfiguration"
+        class="btn role-primary"
+        @click="store.$router.push(createLocation)"
+      >
+        {{ t('generic.create') }}
+      </button>
+    </template>
+  </Masthead>
   <DataTable
     :rows="rows"
     :columns="columns"
diff --git a/dashboard/pkg/epinio/list/services.vue b/dashboard/pkg/epinio/list/services.vue
index 4997751d..02e38a8c 100644
--- a/dashboard/pkg/epinio/list/services.vue
+++ b/dashboard/pkg/epinio/list/services.vue
@@ -25,15 +25,14 @@ const createLocation = computed(() =>
   })
 );
 
+// Strict RBAC: only show Create when we know the user has service write perms (hides for view_only)
 const canCreateService = computed(() => {
   const can = store.getters['epinio/can'];
   const perms = store.getters['epinio/permissions']?.();
 
-  if (!can) {
-    return true;
-  }
-  if (!perms || Object.keys(perms).length === 0) {
-    return true;
+  // If we don't have a permission helper or a populated perms map yet, hide Create
+  if (!can || !perms || Object.keys(perms).length === 0) {
+    return false;
   }
 
   return can('service_write') || can('service');
diff --git a/dashboard/pkg/epinio/models/applications.js b/dashboard/pkg/epinio/models/applications.js
index 1d67dea9..e2760eda 100644
--- a/dashboard/pkg/epinio/models/applications.js
+++ b/dashboard/pkg/epinio/models/applications.js
@@ -62,6 +62,7 @@ export default class EpinioApplicationModel extends EpinioNamespacedResource {
     const canEdit = canGetter('app_update') || canGetter('app_write') || canGetter('app');
     const canDelete = canGetter('app_delete') || canGetter('app_write') || canGetter('app');
     const canViewConfig = canGetter('configuration_read') || canGetter('configuration_write');
+    const canExec = canGetter('app_exec');
 
     let skipNextDivider = false;
 
@@ -72,6 +73,10 @@ export default class EpinioApplicationModel extends EpinioNamespacedResource {
         return false;
       }
 
+      if (action.action === 'showAppShell') {
+        return canExec;
+      }
+
       if (action.action === 'showConfiguration') {
         if (!canViewConfig) {
           skipNextDivider = true; // base always has a divider after showConfiguration
@@ -80,8 +85,12 @@ export default class EpinioApplicationModel extends EpinioNamespacedResource {
         }
       }
 
-      if (action.action === 'goToEdit' || action.action === 'goToViewConfig') {
-        return canEdit || canViewConfig;
+      if (action.action === 'goToEdit') {
+        return canEdit;
+      }
+
+      if (action.action === 'goToViewConfig') {
+        return canViewConfig;
       }
 
       if (action.action === 'promptRemove') {
@@ -150,7 +159,10 @@ export default class EpinioApplicationModel extends EpinioNamespacedResource {
     const isRunning = [STATES.RUNNING].includes(this.status);
     const showAppLog = isRunning;
     const showStagingLog = !!this.stage_id;
-    const showAppShell = isRunning;
+    const canGetter = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+    const canExec = canGetter && perms && Object.keys(perms).length > 0 ? canGetter('app_exec') : false;
+    const showAppShell = isRunning && canExec;
 
     if (showAppShell) {
       res.push({
diff --git a/dashboard/pkg/epinio/utils/permissions.ts b/dashboard/pkg/epinio/utils/permissions.ts
index 5ca6a9c9..527d7f4b 100644
--- a/dashboard/pkg/epinio/utils/permissions.ts
+++ b/dashboard/pkg/epinio/utils/permissions.ts
@@ -30,6 +30,9 @@ const ROLE_ACTIONS: Record<string, string[]> = {
     'app_stage',
     'app_deploy',
     'app_export',
+    'configuration_read',
+    'configuration_write',
+    'service_write',
   ],
 
   // Application Manager: full app CRUD and runtime operations, no non-app writes
@@ -52,6 +55,9 @@ const ROLE_ACTIONS: Record<string, string[]> = {
     'app_restart',
     'app_exec',
     'app_portforward',
+    'configuration_read',
+    'configuration_write',
+    'service_write',
   ],
 
   // System Manager: no-delete role, app create/update/runtime plus read-only on other resources
@@ -74,7 +80,9 @@ const ROLE_ACTIONS: Record<string, string[]> = {
     'app_exec',
     'app_portforward',
     'configuration_read',
+    'configuration_write',
     'service_read',
+    'service_write',
     'gitconfig_read',
     'export_registries_read',
   ],

From 862fade50fda17ef2514106d8f9e3e792b5f3142 Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Tue, 10 Mar 2026 11:05:18 -0400
Subject: [PATCH 18/36] fix(show cluster table based on all cluster count, not
 epinio cluster count):

---
 dashboard/pkg/epinio/pages/index.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboard/pkg/epinio/pages/index.vue b/dashboard/pkg/epinio/pages/index.vue
index 6308b553..75767cba 100644
--- a/dashboard/pkg/epinio/pages/index.vue
+++ b/dashboard/pkg/epinio/pages/index.vue
@@ -190,7 +190,7 @@ const columns: DataTableColumn[] = [
     mode="main"
   />
   <div
-    v-else-if="clusters.length === 0"
+    v-else-if="allClusters.length === 0"
     class="root"
   >
     <h2>{{ t('epinio.instances.none.header') }}</h2>

From a8e21c3ff2542c805fd64350000d7008d0d500e4 Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Tue, 10 Mar 2026 11:21:37 -0400
Subject: [PATCH 19/36] chore(bump for rc1):

---
 dashboard/package.json            | 2 +-
 dashboard/pkg/epinio/package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dashboard/package.json b/dashboard/package.json
index 1e4b481a..56a972c1 100644
--- a/dashboard/package.json
+++ b/dashboard/package.json
@@ -1,6 +1,6 @@
 {
   "name": "epinio",
-  "version": "v1.13.9",
+  "version": "v1.13.10-rc1",
   "engines": {
     "node": ">=20"
   },
diff --git a/dashboard/pkg/epinio/package.json b/dashboard/pkg/epinio/package.json
index 096982e3..4eae0272 100644
--- a/dashboard/pkg/epinio/package.json
+++ b/dashboard/pkg/epinio/package.json
@@ -1,7 +1,7 @@
 {
   "name": "epinio",
   "description": "A Rancher Extension of The Application Development Engine for Kubernetes",
-  "version": "1.13.9",
+  "version": "1.13.10-rc1",
   "private": false,
   "rancher": {
     "annotations": {

From 77ad6e54c8afb1e940a508cca075d00b0481a917 Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Tue, 10 Mar 2026 11:52:14 -0400
Subject: [PATCH 20/36] chore(bump to rc2 due to failed uploads):

---
 dashboard/package.json            | 2 +-
 dashboard/pkg/epinio/package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dashboard/package.json b/dashboard/package.json
index 56a972c1..dc15cb0d 100644
--- a/dashboard/package.json
+++ b/dashboard/package.json
@@ -1,6 +1,6 @@
 {
   "name": "epinio",
-  "version": "v1.13.10-rc1",
+  "version": "v1.13.10-rc2",
   "engines": {
     "node": ">=20"
   },
diff --git a/dashboard/pkg/epinio/package.json b/dashboard/pkg/epinio/package.json
index 4eae0272..90a154f2 100644
--- a/dashboard/pkg/epinio/package.json
+++ b/dashboard/pkg/epinio/package.json
@@ -1,7 +1,7 @@
 {
   "name": "epinio",
   "description": "A Rancher Extension of The Application Development Engine for Kubernetes",
-  "version": "1.13.10-rc1",
+  "version": "1.13.10-rc2",
   "private": false,
   "rancher": {
     "annotations": {

From 5a643676d29206f75dc7062a50c6858fbe27b8e9 Mon Sep 17 00:00:00 2001
From: mohit3334 <sanghvipranay17@gmail.com>
Date: Wed, 11 Mar 2026 12:47:46 +0530
Subject: [PATCH 21/36] enforce RBAC for Edit Config and Shell in applications

- Hide "Edit Config" in view mode when user lacks configuration_write/configuration
- Hide Shell action for users without app_exec (e.g. view_only)
- Add .hide-edit-config CSS when button should be hidden.
---
 dashboard/pkg/epinio/edit/applications.vue      | 17 ++++++++++++++++-
 .../pkg/epinio/models/application-instance.js   | 15 +++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/dashboard/pkg/epinio/edit/applications.vue b/dashboard/pkg/epinio/edit/applications.vue
index 15c6dae7..cef0d195 100644
--- a/dashboard/pkg/epinio/edit/applications.vue
+++ b/dashboard/pkg/epinio/edit/applications.vue
@@ -87,6 +87,17 @@ const shouldShowButtons = computed(
 const showSourceTab = computed(() => {
   return props.mode === _EDIT
 });
+
+// Hide "Edit Config" in view mode for users without configuration write (e.g. view_only)
+const canEditConfig = computed(() => {
+  const can = store.getters['epinio/can'];
+  const perms = store.getters['epinio/permissions']?.();
+  if (!can || !perms || Object.keys(perms).length === 0) {
+    return false;
+  }
+  return can('configuration_write') || can('configuration');
+});
+const hideEditConfigButton = computed(() => props.mode === 'view' && !canEditConfig.value);
 const validationPassed = computed(() => !Object.values(tabErrors).find((error) => error));
 
 const done = () => {
@@ -186,7 +197,7 @@ function validate(value: boolean, tab: string) {
   <Loading v-if="!value" />
   <CruResource
     v-else
-    :class="shouldShowButtons"
+    :class="[shouldShowButtons, { 'hide-edit-config': hideEditConfigButton }]"
     :can-yaml="false"
     :mode="mode"
     :resource="value"
@@ -302,4 +313,8 @@ function validate(value: boolean, tab: string) {
   }
 }
 
+/* Hide "Edit Config" for view_only when opened from Show Configuration */
+.hide-edit-config .cru__footer .btn.role-primary {
+  display: none !important;
+}
 </style>
diff --git a/dashboard/pkg/epinio/models/application-instance.js b/dashboard/pkg/epinio/models/application-instance.js
index cff382a9..1119b928 100644
--- a/dashboard/pkg/epinio/models/application-instance.js
+++ b/dashboard/pkg/epinio/models/application-instance.js
@@ -3,6 +3,21 @@ import { EPINIO_PRODUCT_NAME } from '../types';
 
 export default class ApplicationInstanceResource extends Resource {
   get _availableActions() {
+    const canGetter = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+
+    // If permissions are not loaded yet, hide Shell (API will still enforce RBAC if somehow called)
+    if (!canGetter || !perms || Object.keys(perms).length === 0) {
+      return [];
+    }
+
+    const canExec = canGetter('app_exec');
+
+    if (!canExec) {
+      // view_only / read-only roles don't get the Shell action
+      return [];
+    }
+
     return [{
       action:  'showAppShell',
       label:   this.t('epinio.applications.actions.onlyShell.label'),

From e05384734bdae9cfb8c1bb70ee63086af9395fa7 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Thu, 12 Mar 2026 14:09:11 +0530
Subject: [PATCH 22/36] show applications table for every namespace when empty

- Build groupedByNamespace from all namespaces, not only those with apps
- Load namespaces on applications page so empty namespaces get a table
- Keeps UI consistent and avoids confusion that a namespace does not exist
---
 .../pages/c/_cluster/applications/index.vue   | 32 ++++++++++++++-----
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue b/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue
index abaa0e0f..108e1253 100644
--- a/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue
+++ b/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue
@@ -29,8 +29,10 @@ const openCreateRoute = () => {
 };
 
 const rows = computed(() => store.getters['epinio/all'](resource));
+const allNamespaces = computed(() => store.getters['epinio/all'](EPINIO_TYPES.NAMESPACE) || []);
 
-// Group applications by namespace
+// Group applications by namespace. Include every namespace so the applications table
+// is shown even when a namespace has no applications.
 const groupedByNamespace = computed(() => {
   // Access the cache key to trigger namespace filter changes
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -39,19 +41,31 @@ const groupedByNamespace = computed(() => {
 
   const groups: Record<string, any[]> = {};
 
+  // Determine which namespace names to show (all, or filtered)
+  const showAll = !activeNamespaces || Object.keys(activeNamespaces).length === 0;
+  const namespaceNamesToShow = new Set<string>();
+
+  allNamespaces.value.forEach((ns: any) => {
+    const name = ns.meta?.name || ns.name;
+    if (name && (showAll || activeNamespaces[name])) {
+      namespaceNamesToShow.add(name);
+    }
+  });
+
+  // Initialize every visible namespace with an empty apps array
+  namespaceNamesToShow.forEach((name) => {
+    groups[name] = [];
+  });
+
+  // Assign each application to its namespace group
   rows.value.forEach((app: any) => {
     const namespace = app.meta?.namespace || 'default';
-
-    // Only include this namespace if it's in the active filter
-    // If no filter is active or filter is empty, show all namespaces
-    if (!activeNamespaces || Object.keys(activeNamespaces).length === 0 || activeNamespaces[namespace]) {
-      if (!groups[namespace]) {
-        groups[namespace] = [];
-      }
+    if (namespaceNamesToShow.has(namespace)) {
       groups[namespace].push(app);
     }
   });
 
+  // Fallback when no namespaces are loaded yet
   if (Object.keys(groups).length === 0) {
     groups['workspace'] = [];
   }
@@ -103,6 +117,8 @@ const columns: DataTableColumn[] = [
 
 onMounted(async () => {
   await store.dispatch('epinio/findAll', { type: EPINIO_TYPES.APP });
+  // Ensure namespaces are loaded so we can show the applications table for every namespace (EPINIO-494)
+  await store.dispatch('epinio/findAll', { type: EPINIO_TYPES.NAMESPACE });
   // Non-blocking fetch
   store.dispatch('epinio/findAll', { type: EPINIO_TYPES.CONFIGURATION });
   store.dispatch('epinio/findAll', { type: EPINIO_TYPES.SERVICE_INSTANCE });

From af6654a24982a7f300f0d339cf10341dcb309e00 Mon Sep 17 00:00:00 2001
From: mohit3334 <sanghvipranay17@gmail.com>
Date: Fri, 13 Mar 2026 18:31:36 +0530
Subject: [PATCH 23/36] Enforce RBAC for Edit Config and Create in Epinio UI

- Always hide the primary "Edit Config" footer button in the applications edit dialog when the user lacks configuration write permissions, regardless of view vs edit mode.
- Restrict the "Edit Config" menu action so it is only shown to users who have configuration write permissions.
- Add a canEdit getter on the application model so the Resource Detail drawer only shows "Edit Config" when the user can actually modify configuration.
- Tighten logic for the "Create Application" button so it is only shown when loaded permissions confirm the user has app create/write capabilities, keeping it hidden for view-only users.
---
 dashboard/pkg/epinio/edit/applications.vue    |  6 ++++--
 dashboard/pkg/epinio/models/applications.js   | 18 ++++++++++++++++-
 .../pages/c/_cluster/applications/index.vue   | 12 ++++-------
 dashboard/pkg/epinio/utils/permissions.ts     | 20 ++++++++++++++++++-
 4 files changed, 44 insertions(+), 12 deletions(-)

diff --git a/dashboard/pkg/epinio/edit/applications.vue b/dashboard/pkg/epinio/edit/applications.vue
index cef0d195..c3fdb3b9 100644
--- a/dashboard/pkg/epinio/edit/applications.vue
+++ b/dashboard/pkg/epinio/edit/applications.vue
@@ -88,7 +88,7 @@ const showSourceTab = computed(() => {
   return props.mode === _EDIT
 });
 
-// Hide "Edit Config" in view mode for users without configuration write (e.g. view_only)
+// Hide "Edit Config" in any mode for users without configuration write (e.g. view_only)
 const canEditConfig = computed(() => {
   const can = store.getters['epinio/can'];
   const perms = store.getters['epinio/permissions']?.();
@@ -97,7 +97,9 @@ const canEditConfig = computed(() => {
   }
   return can('configuration_write') || can('configuration');
 });
-const hideEditConfigButton = computed(() => props.mode === 'view' && !canEditConfig.value);
+// If the user lacks config write perms, never show the primary "Edit Config" footer button,
+// regardless of how this dialog was opened (view or edit route).
+const hideEditConfigButton = computed(() => !canEditConfig.value);
 const validationPassed = computed(() => !Object.values(tabErrors).find((error) => error));
 
 const done = () => {
diff --git a/dashboard/pkg/epinio/models/applications.js b/dashboard/pkg/epinio/models/applications.js
index e2760eda..3cd47197 100644
--- a/dashboard/pkg/epinio/models/applications.js
+++ b/dashboard/pkg/epinio/models/applications.js
@@ -62,6 +62,7 @@ export default class EpinioApplicationModel extends EpinioNamespacedResource {
     const canEdit = canGetter('app_update') || canGetter('app_write') || canGetter('app');
     const canDelete = canGetter('app_delete') || canGetter('app_write') || canGetter('app');
     const canViewConfig = canGetter('configuration_read') || canGetter('configuration_write');
+    const canEditConfig = canGetter('configuration_write') || canGetter('configuration');
     const canExec = canGetter('app_exec');
 
     let skipNextDivider = false;
@@ -90,7 +91,9 @@ export default class EpinioApplicationModel extends EpinioNamespacedResource {
       }
 
       if (action.action === 'goToViewConfig') {
-        return canViewConfig;
+        // "Edit Config" menu entry should only be shown to users
+        // who actually have configuration write permissions.
+        return canEditConfig;
       }
 
       if (action.action === 'promptRemove') {
@@ -101,6 +104,19 @@ export default class EpinioApplicationModel extends EpinioNamespacedResource {
     });
   }
 
+  // Used by ResourceDetailDrawer (Show Configuration) to show/hide the "Edit Config" button.
+  // Require configuration_write so view-only users don't see it.
+  get canEdit() {
+    const base = this.canUpdate && this.canCustomEdit;
+    const canGetter = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+    if (!canGetter || !perms || Object.keys(perms).length === 0) {
+      return false;
+    }
+    const canEditConfig = canGetter('configuration_write') || canGetter('configuration');
+    return !!(base && canEditConfig);
+  }
+
   get details() {
     const res = [];
 
diff --git a/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue b/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue
index a7bce3ef..971bea01 100644
--- a/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue
+++ b/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue
@@ -28,18 +28,14 @@ const openCreateRoute = () => {
   store.$router.push(createLocation.value);
 };
 
+// Strict RBAC: only show Create when we know the user has app write perms (hides for view_only)
 const canCreateApp = computed(() => {
   const can = store.getters['epinio/can'];
   const perms = store.getters['epinio/permissions']?.();
 
-  // When permissions haven't loaded yet (me not fetched) or store unavailable,
-  // default to showing Create — API will enforce RBAC. Avoids hiding for users
-  // who have permission when /me has not completed or returns unexpected data.
-  if (!can) {
-    return true;
-  }
-  if (!perms || Object.keys(perms).length === 0) {
-    return true;
+  // If we don't have a permission helper or a populated perms map yet, hide Create
+  if (!can || !perms || Object.keys(perms).length === 0) {
+    return false;
   }
 
   // Any of these actions implies the ability to create an app
diff --git a/dashboard/pkg/epinio/utils/permissions.ts b/dashboard/pkg/epinio/utils/permissions.ts
index 527d7f4b..a6c0ced5 100644
--- a/dashboard/pkg/epinio/utils/permissions.ts
+++ b/dashboard/pkg/epinio/utils/permissions.ts
@@ -3,6 +3,18 @@ import type { EpinioRole } from '../types';
 // Mapping from Epinio role IDs to the action IDs they imply.
 // These should stay in sync with the server-side role definitions.
 const ROLE_ACTIONS: Record<string, string[]> = {
+  // Default "Epinio User Role" when backend returns id "user" (e.g. RBAC not yet applied).
+  // Treat as read-only so Create/Edit stay hidden until server sends proper roles (e.g. view_only).
+  user: [
+    'namespace_read',
+    'app_read',
+    'app_logs',
+    'configuration_read',
+    'service_read',
+    'gitconfig_read',
+    'export_registries_read',
+  ],
+
   // Read-only role
   view_only: [
     'namespace_read',
@@ -17,6 +29,7 @@ const ROLE_ACTIONS: Record<string, string[]> = {
   // Application Developer: create/update applications but no delete or non-app writes
   application_developer: [
     'namespace_read',
+    'namespace_write',
     'app_read',
     'app_logs',
     'app_create',
@@ -38,6 +51,7 @@ const ROLE_ACTIONS: Record<string, string[]> = {
   // Application Manager: full app CRUD and runtime operations, no non-app writes
   application_manager: [
     'namespace_read',
+    'namespace_write',
     'app_read',
     'app_logs',
     'app_create',
@@ -63,6 +77,7 @@ const ROLE_ACTIONS: Record<string, string[]> = {
   // System Manager: no-delete role, app create/update/runtime plus read-only on other resources
   system_manager: [
     'namespace_read',
+    'namespace_write',
     'app_read',
     'app_logs',
     'app_create',
@@ -88,9 +103,12 @@ const ROLE_ACTIONS: Record<string, string[]> = {
   ],
 };
 
+// Actions only the admin role has (server-side admin can create/delete namespaces; other roles cannot).
+const ADMIN_ONLY_ACTIONS = ['namespace_write', 'namespace'];
+
 // Union of all actions for the admin role – effectively "everything".
 const ADMIN_ACTIONS = Array.from(
-  new Set<string>(Object.values(ROLE_ACTIONS).flat()),
+  new Set<string>([...Object.values(ROLE_ACTIONS).flat(), ...ADMIN_ONLY_ACTIONS]),
 );
 
 export type EpinioPermissions = Record<string, boolean>;

From ccb3e7ec457f5b37afd1d819945ea5c0dca864c6 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Wed, 18 Mar 2026 14:54:15 +0530
Subject: [PATCH 24/36] add Install button to trigger Epinio install on
 unregistered clusters

Adds an Actions column to the Epinio instances table with an Install
button that appears only for clusters where Epinio is not yet installed.
Clicking the button opens an InstallDialog that collects domain,
targetNamespace, and version, checks for an existing active install to
prevent duplicates, creates an InstallEpinio CR on the target cluster
via the Rancher K8s proxy, and polls the CR status conditions to show
live progress (Progressing / Available / Degraded) until the operator
completes the Helm-based install.
---
 dashboard/pkg/epinio/dialog/InstallDialog.vue | 339 ++++++++++++++++++
 dashboard/pkg/epinio/index.ts                 |   4 +
 dashboard/pkg/epinio/pages/index.vue          |  23 ++
 3 files changed, 366 insertions(+)
 create mode 100644 dashboard/pkg/epinio/dialog/InstallDialog.vue

diff --git a/dashboard/pkg/epinio/dialog/InstallDialog.vue b/dashboard/pkg/epinio/dialog/InstallDialog.vue
new file mode 100644
index 00000000..f36984cc
--- /dev/null
+++ b/dashboard/pkg/epinio/dialog/InstallDialog.vue
@@ -0,0 +1,339 @@
+<script setup lang="ts">
+import { ref, onUnmounted } from 'vue';
+import { useStore } from 'vuex';
+
+import { LabeledInput } from '@components/Form/LabeledInput';
+import { Banner } from '@components/Banner';
+import EpinioCluster from '../models/epiniomgmt/epinio.io.management.cluster';
+
+const store = useStore();
+
+const emit = defineEmits<{
+  (e: 'close'): void
+}>();
+
+const props = defineProps<{
+  cluster: EpinioCluster,
+}>();
+
+const OPERATOR_NAMESPACE = 'epinio-system';
+const CR_GROUP = 'epinio.apps.example.com';
+const CR_VERSION = 'v1alpha1';
+const CR_PLURAL = 'installepinios';
+
+// ---- form state ----
+const domain = ref('');
+const targetNamespace = ref('epinio');
+const version = ref('');
+
+// ---- page state ----
+type Phase = 'form' | 'polling' | 'done' | 'failed';
+const phase = ref<Phase>('form');
+const busy = ref(false);
+const errors = ref<string[]>([]);
+
+// ---- installed CR identity (for polling) ----
+const crName = ref('');
+const statusMessage = ref('');
+
+// ---- polling ----
+let pollTimer: ReturnType<typeof setTimeout> | null = null;
+
+onUnmounted(() => stopPolling());
+
+function stopPolling() {
+  if (pollTimer !== null) {
+    clearTimeout(pollTimer);
+    pollTimer = null;
+  }
+}
+
+// ---- helpers ----
+function k8sUrl(name = ''): string {
+  const base = `/k8s/clusters/${ props.cluster.id }/apis/${ CR_GROUP }/${ CR_VERSION }/namespaces/${ OPERATOR_NAMESPACE }/${ CR_PLURAL }`;
+
+  return name ? `${ base }/${ name }` : base;
+}
+
+async function k8sRequest(opt: Record<string, any>) {
+  return store.dispatch('cluster/request', opt, { root: true });
+}
+
+// ---- duplicate check ----
+async function hasActiveInstall(ns: string): Promise<boolean> {
+  try {
+    const list = await k8sRequest({ url: k8sUrl() });
+    const items: any[] = list?.items ?? [];
+
+    return items.some((item: any) => {
+      if (item.spec?.targetNamespace !== ns) return false;
+      const conditions: any[] = item.status?.conditions ?? [];
+      const available = conditions.find((c: any) => c.type === 'Available');
+      const progressing = conditions.find((c: any) => c.type === 'Progressing');
+
+      return available?.status === 'True' || progressing?.status === 'True';
+    });
+  } catch {
+    return false;
+  }
+}
+
+// ---- submit ----
+async function install() {
+  errors.value = [];
+  if (!domain.value.trim()) errors.value.push('Domain is required');
+  if (!targetNamespace.value.trim()) errors.value.push('Target Namespace is required');
+  if (!version.value.trim()) errors.value.push('Version is required');
+  if (errors.value.length) return;
+
+  busy.value = true;
+  try {
+    const duplicate = await hasActiveInstall(targetNamespace.value.trim());
+
+    if (duplicate) {
+      errors.value = [`An install for namespace "${ targetNamespace.value.trim() }" is already in progress or completed on this cluster.`];
+      busy.value = false;
+      return;
+    }
+
+    const res = await k8sRequest({
+      url:     k8sUrl(),
+      method:  'post',
+      headers: { 'content-type': 'application/json' },
+      data:    {
+        apiVersion: `${ CR_GROUP }/${ CR_VERSION }`,
+        kind:       'InstallEpinio',
+        metadata:   {
+          generateName: 'install-epinio-',
+          namespace:    OPERATOR_NAMESPACE,
+        },
+        spec: {
+          domain:          domain.value.trim(),
+          targetNamespace: targetNamespace.value.trim(),
+          version:         version.value.trim(),
+        },
+      },
+    });
+
+    crName.value = res?.metadata?.name ?? '';
+    statusMessage.value = 'Install request accepted — waiting for operator…';
+    phase.value = 'polling';
+    schedulePoll();
+  } catch (err: any) {
+    errors.value = [err?.data?.message || err?.message || String(err)];
+  } finally {
+    busy.value = false;
+  }
+}
+
+// ---- polling loop ----
+function schedulePoll(delayMs = 4000) {
+  pollTimer = setTimeout(poll, delayMs);
+}
+
+async function poll() {
+  if (!crName.value) return;
+  try {
+    const cr = await k8sRequest({ url: k8sUrl(crName.value) });
+    const conditions: any[] = cr?.status?.conditions ?? [];
+
+    const available = conditions.find((c: any) => c.type === 'Available');
+    const progressing = conditions.find((c: any) => c.type === 'Progressing');
+    const degraded = conditions.find((c: any) => c.type === 'Degraded');
+
+    if (available?.status === 'True') {
+      statusMessage.value = available.message || 'Epinio installed successfully.';
+      phase.value = 'done';
+      stopPolling();
+    } else if (degraded?.status === 'True') {
+      statusMessage.value = degraded.message || 'Install failed.';
+      phase.value = 'failed';
+      stopPolling();
+    } else if (progressing?.status === 'True') {
+      statusMessage.value = progressing.message || 'Install is in progress…';
+      schedulePoll();
+    } else {
+      statusMessage.value = 'Waiting for operator to start…';
+      schedulePoll();
+    }
+  } catch {
+    statusMessage.value = 'Could not reach the cluster — retrying…';
+    schedulePoll(8000);
+  }
+}
+
+function close() {
+  stopPolling();
+  emit('close');
+}
+</script>
+
+<template>
+  <div class="install-dialog">
+    <h4 class="install-dialog__title">
+      Install Epinio on <strong>{{ cluster.name }}</strong>
+    </h4>
+
+    <!-- ── FORM ── -->
+    <template v-if="phase === 'form'">
+      <div
+        v-if="errors.length"
+        class="install-dialog__errors"
+      >
+        <Banner
+          v-for="(err, idx) in errors"
+          :key="idx"
+          color="error"
+          :label="err"
+        />
+      </div>
+
+      <form
+        class="install-dialog__form"
+        @submit.prevent="!busy && install()"
+      >
+        <div class="mb-20">
+          <LabeledInput
+            v-model:value="domain"
+            label="Domain"
+            placeholder="e.g. demo.example.test"
+            :required="true"
+            :disabled="busy"
+          />
+        </div>
+        <div class="mb-20">
+          <LabeledInput
+            v-model:value="targetNamespace"
+            label="Target Namespace"
+            placeholder="epinio"
+            :required="true"
+            :disabled="busy"
+          />
+        </div>
+        <div class="mb-20">
+          <LabeledInput
+            v-model:value="version"
+            label="Version"
+            placeholder="e.g. 1.0.0"
+            :required="true"
+            :disabled="busy"
+          />
+        </div>
+
+        <div class="install-dialog__actions">
+          <button
+            type="button"
+            class="btn role-secondary"
+            :disabled="busy"
+            @click="close"
+          >
+            Cancel
+          </button>
+          <button
+            type="submit"
+            class="btn role-primary"
+            :class="{ disabled: busy }"
+            :disabled="busy"
+          >
+            {{ busy ? 'Checking…' : 'Install' }}
+          </button>
+        </div>
+      </form>
+    </template>
+
+    <!-- ── POLLING / IN PROGRESS ── -->
+    <template v-else-if="phase === 'polling'">
+      <div class="install-dialog__status">
+        <i class="icon icon-spinner icon-spin install-dialog__spinner" />
+        <p>{{ statusMessage }}</p>
+      </div>
+      <div class="install-dialog__actions">
+        <button
+          class="btn role-secondary"
+          @click="close"
+        >
+          Close (install continues in background)
+        </button>
+      </div>
+    </template>
+
+    <!-- ── SUCCESS ── -->
+    <template v-else-if="phase === 'done'">
+      <Banner
+        color="success"
+        :label="statusMessage"
+      />
+      <div class="install-dialog__actions">
+        <button
+          class="btn role-primary"
+          @click="close"
+        >
+          Close
+        </button>
+      </div>
+    </template>
+
+    <!-- ── FAILED ── -->
+    <template v-else-if="phase === 'failed'">
+      <Banner
+        color="error"
+        :label="statusMessage"
+      />
+      <div class="install-dialog__actions">
+        <button
+          class="btn role-primary"
+          @click="close"
+        >
+          Close
+        </button>
+      </div>
+    </template>
+  </div>
+</template>
+
+<style lang="scss" scoped>
+.install-dialog {
+  padding: 24px;
+  display: flex;
+  flex-direction: column;
+  min-width: 440px;
+
+  &__title {
+    margin-bottom: 20px;
+  }
+
+  &__errors {
+    margin-bottom: 16px;
+  }
+
+  &__form {
+    display: flex;
+    flex-direction: column;
+  }
+
+  &__status {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    padding: 20px 0;
+    gap: 12px;
+
+    p {
+      text-align: center;
+      color: var(--body-text);
+    }
+  }
+
+  &__spinner {
+    font-size: 2rem;
+    color: var(--primary);
+  }
+
+  &__actions {
+    display: flex;
+    justify-content: flex-end;
+    gap: 10px;
+    margin-top: 16px;
+  }
+}
+</style>
diff --git a/dashboard/pkg/epinio/index.ts b/dashboard/pkg/epinio/index.ts
index 59740b78..6cf216f8 100644
--- a/dashboard/pkg/epinio/index.ts
+++ b/dashboard/pkg/epinio/index.ts
@@ -72,6 +72,10 @@ export default function(plugin: IPlugin) {
   const UnsavedChangesDialog = require('./dialog/UnsavedChangesDialog.vue'); // eslint-disable-line @typescript-eslint/no-require-imports
   plugin.register('component', 'UnsavedChangesDialog', UnsavedChangesDialog.default || UnsavedChangesDialog);
 
+  // Register install Epinio dialog
+  const InstallDialog = require('./dialog/InstallDialog.vue'); // eslint-disable-line @typescript-eslint/no-require-imports
+  plugin.register('component', 'InstallDialog', InstallDialog.default || InstallDialog);
+
   // Add action button in the menu of each object belonging to Epinio's applications
   plugin.addAction(
     ActionLocation.TABLE,
diff --git a/dashboard/pkg/epinio/pages/index.vue b/dashboard/pkg/epinio/pages/index.vue
index 6308b553..1019bcac 100644
--- a/dashboard/pkg/epinio/pages/index.vue
+++ b/dashboard/pkg/epinio/pages/index.vue
@@ -85,6 +85,13 @@ const rediscover = async (buttonCb: (success: boolean) => void)  => {
   buttonCb(true);
 }
 
+const openInstall = (c: EpinioCluster) => {
+  store.dispatch('cluster/promptModal', {
+    component:      'InstallDialog',
+    componentProps: { cluster: c },
+  });
+};
+
 const login = async (c: EpinioCluster) =>{
   const isLoggedIn = await epinioAuth.isLoggedIn(c.createAuthConfig(EpinioAuthTypes.AGNOSTIC));
 
@@ -180,6 +187,11 @@ const columns: DataTableColumn[] = [
   {
     field: 'version',
     label: 'Version'
+  },
+  {
+    field:    'actions',
+    label:    'Actions',
+    width:    '120px'
   }
 ];
 </script>
@@ -249,6 +261,17 @@ const columns: DataTableColumn[] = [
             </template>
           </div>
         </template>
+        <template #cell:actions="{row}">
+          <div class="epinio-row">
+            <button
+              v-if="row.state === 'uninstalled'"
+              class="btn btn-sm role-primary"
+              @click="openInstall(row)"
+            >
+              Install
+            </button>
+          </div>
+        </template>
       </DataTable>
 
     </div>

From d11210ea15b57478145b86b49c5004b8a14424f0 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Wed, 18 Mar 2026 20:54:14 +0530
Subject: [PATCH 25/36] Update index.vue

---
 dashboard/pkg/epinio/pages/index.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboard/pkg/epinio/pages/index.vue b/dashboard/pkg/epinio/pages/index.vue
index 1019bcac..ca2010c7 100644
--- a/dashboard/pkg/epinio/pages/index.vue
+++ b/dashboard/pkg/epinio/pages/index.vue
@@ -202,7 +202,7 @@ const columns: DataTableColumn[] = [
     mode="main"
   />
   <div
-    v-else-if="clusters.length === 0"
+    v-else-if="allClusters.length === 0"
     class="root"
   >
     <h2>{{ t('epinio.instances.none.header') }}</h2>

From 69800cddb88235c3563b933d6c083f0e36dd3b47 Mon Sep 17 00:00:00 2001
From: Pranay Sanghvi <sanghvipranay17@gmail.com>
Date: Thu, 19 Mar 2026 09:50:11 +0530
Subject: [PATCH 26/36] Update InstallDialog.vue

---
 dashboard/pkg/epinio/dialog/InstallDialog.vue | 585 ++++++++++++++++--
 1 file changed, 535 insertions(+), 50 deletions(-)

diff --git a/dashboard/pkg/epinio/dialog/InstallDialog.vue b/dashboard/pkg/epinio/dialog/InstallDialog.vue
index f36984cc..baeabc7e 100644
--- a/dashboard/pkg/epinio/dialog/InstallDialog.vue
+++ b/dashboard/pkg/epinio/dialog/InstallDialog.vue
@@ -16,28 +16,40 @@ const props = defineProps<{
   cluster: EpinioCluster,
 }>();
 
-const OPERATOR_NAMESPACE = 'epinio-system';
-const CR_GROUP = 'epinio.apps.example.com';
-const CR_VERSION = 'v1alpha1';
-const CR_PLURAL = 'installepinios';
-
-// ---- form state ----
-const domain = ref('');
+// ── constants ──────────────────────────────────────────────────────────────
+const OPERATOR_NAMESPACE  = 'epinio-system';
+const OPERATOR_IMAGE      = 'ghcr.io/epinio/install-operator:latest';
+const OPERATOR_DEPLOYMENT = 'install-operator-controller-manager';
+const OPERATOR_SA         = 'controller-manager';
+const CR_GROUP            = 'epinio.apps.example.com';
+const CR_VERSION          = 'v1alpha1';
+const CR_PLURAL           = 'installepinios';
+
+// ── form state ─────────────────────────────────────────────────────────────
+const domain          = ref('');
 const targetNamespace = ref('epinio');
-const version = ref('');
-
-// ---- page state ----
-type Phase = 'form' | 'polling' | 'done' | 'failed';
-const phase = ref<Phase>('form');
-const busy = ref(false);
-const errors = ref<string[]>([]);
-
-// ---- installed CR identity (for polling) ----
-const crName = ref('');
+const version         = ref('');
+
+// ── page state ─────────────────────────────────────────────────────────────
+type Phase = 'form' | 'bootstrapping' | 'polling' | 'done' | 'failed';
+const phase         = ref<Phase>('form');
+const busy          = ref(false);
+const errors        = ref<string[]>([]);
+const bootstrapStep = ref('');
+
+// ── steps list for bootstrapping UI ────────────────────────────────────────
+type StepStatus = 'pending' | 'running' | 'done' | 'skipped';
+interface BootstrapStep { label: string; status: StepStatus }
+const bootstrapSteps = ref<BootstrapStep[]>([]);
+
+// ── installed CR identity (for polling) ────────────────────────────────────
+const crName        = ref('');
 const statusMessage = ref('');
 
-// ---- polling ----
+// ── polling ────────────────────────────────────────────────────────────────
 let pollTimer: ReturnType<typeof setTimeout> | null = null;
+let pollCount = 0;
+const POLL_MAX = 90; // 90 × 4 s = 6 min max wait for operator
 
 onUnmounted(() => stopPolling());
 
@@ -48,9 +60,15 @@ function stopPolling() {
   }
 }
 
-// ---- helpers ----
-function k8sUrl(name = ''): string {
-  const base = `/k8s/clusters/${ props.cluster.id }/apis/${ CR_GROUP }/${ CR_VERSION }/namespaces/${ OPERATOR_NAMESPACE }/${ CR_PLURAL }`;
+// ── helpers ────────────────────────────────────────────────────────────────
+const cid = () => props.cluster.id;
+
+function rawUrl(path: string) {
+  return `/k8s/clusters/${ cid() }${ path }`;
+}
+
+function crUrl(name = '') {
+  const base = rawUrl(`/apis/${ CR_GROUP }/${ CR_VERSION }/namespaces/${ OPERATOR_NAMESPACE }/${ CR_PLURAL }`);
 
   return name ? `${ base }/${ name }` : base;
 }
@@ -59,17 +77,390 @@ async function k8sRequest(opt: Record<string, any>) {
   return store.dispatch('cluster/request', opt, { root: true });
 }
 
-// ---- duplicate check ----
+function extractErrorMessage(err: any): string {
+  if (typeof err === 'string') return err;
+  if (err?._status) {
+    const body = err?.message || err?.reason || err?._statusText;
+
+    if (body) return `${ err._status }: ${ body }`;
+
+    return `Request failed with status ${ err._status }`;
+  }
+  if (err?.response?.data?.message) return err.response.data.message;
+  if (err?.message) return err.message;
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return 'An unknown error occurred';
+  }
+}
+
+async function applyResource(url: string, data: any): Promise<void> {
+  try {
+    await k8sRequest({ url, method: 'post', headers: { 'content-type': 'application/json' }, data });
+  } catch (err: any) {
+    const status = err?._status || err?.response?.status;
+
+    if (status !== 409) throw err; // surface all non-conflict errors (including 422 validation)
+
+    // 409 = resource already exists → patch it so stale resources get updated
+    const name = data?.metadata?.name;
+
+    if (!name) return;
+    try {
+      await k8sRequest({
+        url:     `${ url }/${ name }`,
+        method:  'patch',
+        headers: { 'content-type': 'application/strategic-merge-patch+json' },
+        data,
+      });
+    } catch {
+      // patch failed - resource is there, close enough
+    }
+  }
+}
+
+function setStep(label: string) {
+  bootstrapStep.value = label;
+  const step = bootstrapSteps.value.find((s) => s.label === label);
+
+  if (step) step.status = 'running';
+}
+
+function completeStep(label: string, skipped = false) {
+  const step = bootstrapSteps.value.find((s) => s.label === label);
+
+  if (step) step.status = skipped ? 'skipped' : 'done';
+}
+
+// ── operator bootstrap ─────────────────────────────────────────────────────
+async function isOperatorDeployed(): Promise<boolean> {
+  try {
+    const dep = await k8sRequest({ url: rawUrl(`/apis/apps/v1/namespaces/${ OPERATOR_NAMESPACE }/deployments/${ OPERATOR_DEPLOYMENT }`) });
+
+    // Only consider it "deployed" if at least one replica is ready
+    return (dep?.status?.readyReplicas ?? 0) >= 1;
+  } catch {
+    return false;
+  }
+}
+
+async function bootstrapOperator(): Promise<void> {
+  phase.value = 'bootstrapping';
+
+  const steps = [
+    'Check operator',
+    'Create namespace',
+    'Register CRD',
+    'Create ServiceAccount',
+    'Configure RBAC',
+    'Deploy operator',
+    'Wait for operator',
+  ];
+
+  bootstrapSteps.value = steps.map((label) => ({ label, status: 'pending' as StepStatus }));
+
+  // 1 ── check if already deployed
+  setStep('Check operator');
+  const deployed = await isOperatorDeployed();
+
+  completeStep('Check operator');
+  if (deployed) {
+    for (const s of bootstrapSteps.value) {
+      if (s.status === 'pending') s.status = 'skipped';
+    }
+    bootstrapStep.value = 'Operator already running — proceeding…';
+    return;
+  }
+
+  // 2 ── namespace
+  setStep('Create namespace');
+  await ensureOperatorNamespace();
+  completeStep('Create namespace');
+
+  // 3 ── CRD
+  setStep('Register CRD');
+  await applyResource(
+    rawUrl('/apis/apiextensions.k8s.io/v1/customresourcedefinitions'),
+    {
+      apiVersion: 'apiextensions.k8s.io/v1',
+      kind:       'CustomResourceDefinition',
+      metadata:   { name: 'installepinios.epinio.apps.example.com' },
+      spec:       {
+        group: CR_GROUP,
+        names: {
+          kind:     'InstallEpinio',
+          listKind: 'InstallEpinioList',
+          plural:   CR_PLURAL,
+          singular: 'installepinio',
+        },
+        scope:    'Namespaced',
+        versions: [{
+          name:    CR_VERSION,
+          served:  true,
+          storage: true,
+          subresources: { status: {} },
+          schema:  {
+            openAPIV3Schema: {
+              type: 'object',
+              required: ['spec'],
+              properties: {
+                apiVersion: { type: 'string' },
+                kind:       { type: 'string' },
+                metadata:   { type: 'object' },
+                spec: {
+                  type: 'object',
+                  properties: {
+                    domain:          { type: 'string' },
+                    targetNamespace: { type: 'string' },
+                    version:         { type: 'string' },
+                    imagePullSecret:          { type: 'string' },
+                    imageRegistry:            { type: 'string' },
+                    imageRegistryUsername:    { type: 'string' },
+                    imageRegistryPassword:    { type: 'string' },
+                  },
+                },
+                status: {
+                  type: 'object',
+                  properties: {
+                    lastUpdateTime: { type: 'string', format: 'date-time' },
+                    conditions: {
+                      type:  'array',
+                      'x-kubernetes-list-type':     'map',
+                      'x-kubernetes-list-map-keys': ['type'],
+                      items: {
+                        type:     'object',
+                        required: ['lastTransitionTime', 'message', 'reason', 'status', 'type'],
+                        properties: {
+                          lastTransitionTime: { type: 'string', format: 'date-time' },
+                          message:            { type: 'string', maxLength: 32768 },
+                          observedGeneration: { type: 'integer', minimum: 0 },
+                          reason:             { type: 'string', minLength: 1, maxLength: 1024 },
+                          status:             { type: 'string', enum: ['True', 'False', 'Unknown'] },
+                          type:               { type: 'string', maxLength: 316 },
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        }],
+      },
+    }
+  );
+  completeStep('Register CRD');
+
+  // 4 ── ServiceAccount
+  setStep('Create ServiceAccount');
+  await applyResource(
+    rawUrl(`/api/v1/namespaces/${ OPERATOR_NAMESPACE }/serviceaccounts`),
+    { apiVersion: 'v1', kind: 'ServiceAccount', metadata: { name: OPERATOR_SA, namespace: OPERATOR_NAMESPACE } }
+  );
+  completeStep('Create ServiceAccount');
+
+  // 5 ── RBAC
+  setStep('Configure RBAC');
+  // Manager ClusterRole
+  await applyResource(
+    rawUrl('/apis/rbac.authorization.k8s.io/v1/clusterroles'),
+    {
+      apiVersion: 'rbac.authorization.k8s.io/v1',
+      kind:       'ClusterRole',
+      metadata:   { name: 'install-operator-manager-role' },
+      rules:      [
+        { apiGroups: [''], resources: ['configmaps', 'namespaces'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'] },
+        { apiGroups: ['batch'], resources: ['jobs'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'] },
+        { apiGroups: [CR_GROUP], resources: [CR_PLURAL], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'] },
+        { apiGroups: [CR_GROUP], resources: [`${ CR_PLURAL }/finalizers`], verbs: ['update'] },
+        { apiGroups: [CR_GROUP], resources: [`${ CR_PLURAL }/status`], verbs: ['get', 'patch', 'update'] },
+      ],
+    }
+  );
+  // Manager ClusterRoleBinding
+  await applyResource(
+    rawUrl('/apis/rbac.authorization.k8s.io/v1/clusterrolebindings'),
+    {
+      apiVersion: 'rbac.authorization.k8s.io/v1',
+      kind:       'ClusterRoleBinding',
+      metadata:   { name: 'install-operator-manager-rolebinding' },
+      roleRef:    { apiGroup: 'rbac.authorization.k8s.io', kind: 'ClusterRole', name: 'install-operator-manager-role' },
+      subjects:   [{ kind: 'ServiceAccount', name: OPERATOR_SA, namespace: OPERATOR_NAMESPACE }],
+    }
+  );
+  // Installer ClusterRole (broad permissions so the Job can run Helm)
+  // escalate + bind verbs are required to create ClusterRoles that grant
+  // permissions the SA holds (e.g. Epinio's "reflector" ClusterRole).
+  await applyResource(
+    rawUrl('/apis/rbac.authorization.k8s.io/v1/clusterroles'),
+    {
+      apiVersion: 'rbac.authorization.k8s.io/v1',
+      kind:       'ClusterRole',
+      metadata:   { name: 'install-operator-installer-role' },
+      rules:      [
+        { apiGroups: ['*'], resources: ['*'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'] },
+        {
+          apiGroups: ['rbac.authorization.k8s.io'],
+          resources: ['clusterroles', 'clusterrolebindings', 'roles', 'rolebindings'],
+          verbs:     ['escalate', 'bind', 'get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+        },
+      ],
+    }
+  );
+  // Installer ClusterRoleBinding
+  await applyResource(
+    rawUrl('/apis/rbac.authorization.k8s.io/v1/clusterrolebindings'),
+    {
+      apiVersion: 'rbac.authorization.k8s.io/v1',
+      kind:       'ClusterRoleBinding',
+      metadata:   { name: 'install-operator-installer-rolebinding' },
+      roleRef:    { apiGroup: 'rbac.authorization.k8s.io', kind: 'ClusterRole', name: 'install-operator-installer-role' },
+      subjects:   [{ kind: 'ServiceAccount', name: OPERATOR_SA, namespace: OPERATOR_NAMESPACE }],
+    }
+  );
+  // Leader-election Role + Binding
+  await applyResource(
+    rawUrl(`/apis/rbac.authorization.k8s.io/v1/namespaces/${ OPERATOR_NAMESPACE }/roles`),
+    {
+      apiVersion: 'rbac.authorization.k8s.io/v1',
+      kind:       'Role',
+      metadata:   { name: 'install-operator-leader-election-role', namespace: OPERATOR_NAMESPACE },
+      rules:      [
+        { apiGroups: [''], resources: ['configmaps'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'] },
+        { apiGroups: ['coordination.k8s.io'], resources: ['leases'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'] },
+        { apiGroups: [''], resources: ['events'], verbs: ['create', 'patch'] },
+      ],
+    }
+  );
+  await applyResource(
+    rawUrl(`/apis/rbac.authorization.k8s.io/v1/namespaces/${ OPERATOR_NAMESPACE }/rolebindings`),
+    {
+      apiVersion: 'rbac.authorization.k8s.io/v1',
+      kind:       'RoleBinding',
+      metadata:   { name: 'install-operator-leader-election-rolebinding', namespace: OPERATOR_NAMESPACE },
+      roleRef:    { apiGroup: 'rbac.authorization.k8s.io', kind: 'Role', name: 'install-operator-leader-election-role' },
+      subjects:   [{ kind: 'ServiceAccount', name: OPERATOR_SA, namespace: OPERATOR_NAMESPACE }],
+    }
+  );
+  completeStep('Configure RBAC');
+
+  // 6 ── Deployment
+  setStep('Deploy operator');
+  await applyResource(
+    rawUrl(`/apis/apps/v1/namespaces/${ OPERATOR_NAMESPACE }/deployments`),
+    {
+      apiVersion: 'apps/v1',
+      kind:       'Deployment',
+      metadata:   {
+        name:      OPERATOR_DEPLOYMENT,
+        namespace: OPERATOR_NAMESPACE,
+        labels:    { 'control-plane': 'controller-manager', 'app.kubernetes.io/name': 'epinio' },
+      },
+      spec: {
+        replicas: 1,
+        selector: { matchLabels: { 'control-plane': 'controller-manager', 'app.kubernetes.io/name': 'epinio' } },
+        template: {
+          metadata: { labels: { 'control-plane': 'controller-manager', 'app.kubernetes.io/name': 'epinio' } },
+          spec:     {
+            serviceAccountName:            OPERATOR_SA,
+            terminationGracePeriodSeconds: 10,
+            containers: [{
+              name:            'manager',
+              image:           OPERATOR_IMAGE,
+              imagePullPolicy: 'Always',
+              command:         ['/manager'],
+              args:            [
+                '--health-probe-bind-address=:8081',
+                '--ui-bind-address=:8082',
+                '--installer-helm-image=alpine/helm:3.18',
+              ],
+              env: [
+                { name: 'POD_NAMESPACE', valueFrom: { fieldRef: { fieldPath: 'metadata.namespace' } } },
+                { name: 'POD_SERVICE_ACCOUNT', valueFrom: { fieldRef: { fieldPath: 'spec.serviceAccountName' } } },
+              ],
+              ports: [{ containerPort: 8082, name: 'ui', protocol: 'TCP' }],
+              livenessProbe:  { httpGet: { path: '/healthz', port: 8081 }, initialDelaySeconds: 15, periodSeconds: 20 },
+              readinessProbe: { httpGet: { path: '/readyz', port: 8081 }, initialDelaySeconds: 5, periodSeconds: 10 },
+              resources: {
+                limits:   { cpu: '500m', memory: '128Mi' },
+                requests: { cpu: '10m', memory: '64Mi' },
+              },
+            }],
+          },
+        },
+      },
+    }
+  );
+  completeStep('Deploy operator');
+
+  // 7 ── wait for pod ready
+  setStep('Wait for operator');
+  await waitForDeploymentReady();
+  completeStep('Wait for operator');
+}
+
+async function waitForDeploymentReady(): Promise<void> {
+  const url = rawUrl(`/apis/apps/v1/namespaces/${ OPERATOR_NAMESPACE }/deployments/${ OPERATOR_DEPLOYMENT }`);
+  const maxAttempts = 36; // 36 × 5 s = 3 min
+
+  for (let i = 0; i < maxAttempts; i++) {
+    await new Promise((resolve) => setTimeout(resolve, 5000));
+    try {
+      const dep = await k8sRequest({ url });
+      const ready = dep?.status?.readyReplicas ?? 0;
+
+      bootstrapStep.value = `Waiting for operator pod… (${ i + 1 }/${ maxAttempts })`;
+      if (ready >= 1) return;
+    } catch {
+      // transient - keep waiting
+    }
+  }
+  throw new Error('Operator did not become ready within 3 minutes. Check pod logs in epinio-system.');
+}
+
+async function waitForCRDReady(): Promise<void> {
+  for (let i = 0; i < 10; i++) {
+    await new Promise((resolve) => setTimeout(resolve, 2000));
+    try {
+      await k8sRequest({ url: crUrl() });
+
+      return;
+    } catch { /* keep waiting */ }
+  }
+}
+
+// ── ensure namespace ────────────────────────────────────────────────────────
+async function ensureOperatorNamespace(): Promise<void> {
+  try {
+    await k8sRequest({ url: rawUrl(`/api/v1/namespaces/${ OPERATOR_NAMESPACE }`) });
+  } catch (err: any) {
+    const status = err?._status || err?.response?.status;
+
+    if (status === 404) {
+      await k8sRequest({
+        url:     rawUrl('/api/v1/namespaces'),
+        method:  'post',
+        headers: { 'content-type': 'application/json' },
+        data:    { apiVersion: 'v1', kind: 'Namespace', metadata: { name: OPERATOR_NAMESPACE } },
+      });
+    } else {
+      throw err;
+    }
+  }
+}
+
+// ── duplicate check ─────────────────────────────────────────────────────────
 async function hasActiveInstall(ns: string): Promise<boolean> {
   try {
-    const list = await k8sRequest({ url: k8sUrl() });
+    const list  = await k8sRequest({ url: crUrl() });
     const items: any[] = list?.items ?? [];
 
     return items.some((item: any) => {
       if (item.spec?.targetNamespace !== ns) return false;
-      const conditions: any[] = item.status?.conditions ?? [];
-      const available = conditions.find((c: any) => c.type === 'Available');
-      const progressing = conditions.find((c: any) => c.type === 'Progressing');
+      const conds: any[] = item.status?.conditions ?? [];
+      const available   = conds.find((c: any) => c.type === 'Available');
+      const progressing = conds.find((c: any) => c.type === 'Progressing');
 
       return available?.status === 'True' || progressing?.status === 'True';
     });
@@ -78,36 +469,42 @@ async function hasActiveInstall(ns: string): Promise<boolean> {
   }
 }
 
-// ---- submit ----
+// ── submit ──────────────────────────────────────────────────────────────────
 async function install() {
   errors.value = [];
-  if (!domain.value.trim()) errors.value.push('Domain is required');
+  if (!domain.value.trim())          errors.value.push('Domain is required');
   if (!targetNamespace.value.trim()) errors.value.push('Target Namespace is required');
-  if (!version.value.trim()) errors.value.push('Version is required');
+  if (!version.value.trim())         errors.value.push('Version is required');
   if (errors.value.length) return;
 
   busy.value = true;
   try {
+    // Step A — bootstrap operator if not present
+    await bootstrapOperator();
+
+    // Step B — wait for CRD to be served (after fresh install)
+    bootstrapStep.value = 'Verifying CRD availability…';
+    await waitForCRDReady();
+
+    // Step C — duplicate guard
     const duplicate = await hasActiveInstall(targetNamespace.value.trim());
 
     if (duplicate) {
       errors.value = [`An install for namespace "${ targetNamespace.value.trim() }" is already in progress or completed on this cluster.`];
-      busy.value = false;
+      phase.value  = 'form';
       return;
     }
 
+    // Step D — create InstallEpinio CR
     const res = await k8sRequest({
-      url:     k8sUrl(),
+      url:     crUrl(),
       method:  'post',
       headers: { 'content-type': 'application/json' },
       data:    {
         apiVersion: `${ CR_GROUP }/${ CR_VERSION }`,
         kind:       'InstallEpinio',
-        metadata:   {
-          generateName: 'install-epinio-',
-          namespace:    OPERATOR_NAMESPACE,
-        },
-        spec: {
+        metadata:   { generateName: 'install-epinio-', namespace: OPERATOR_NAMESPACE },
+        spec:       {
           domain:          domain.value.trim(),
           targetNamespace: targetNamespace.value.trim(),
           version:         version.value.trim(),
@@ -115,31 +512,40 @@ async function install() {
       },
     });
 
-    crName.value = res?.metadata?.name ?? '';
+    crName.value        = res?.metadata?.name ?? '';
     statusMessage.value = 'Install request accepted — waiting for operator…';
-    phase.value = 'polling';
+    phase.value         = 'polling';
+    pollCount           = 0;
     schedulePoll();
   } catch (err: any) {
-    errors.value = [err?.data?.message || err?.message || String(err)];
+    errors.value = [extractErrorMessage(err)];
+    phase.value  = 'form';
   } finally {
     busy.value = false;
   }
 }
 
-// ---- polling loop ----
+// ── polling loop ────────────────────────────────────────────────────────────
 function schedulePoll(delayMs = 4000) {
+  pollCount++;
+  if (pollCount > POLL_MAX) {
+    statusMessage.value = 'Timed out waiting for the operator to start. The operator pod may have failed to pull its image or start. Check: kubectl get pods -n epinio-system';
+    phase.value = 'failed';
+    stopPolling();
+    return;
+  }
   pollTimer = setTimeout(poll, delayMs);
 }
 
 async function poll() {
   if (!crName.value) return;
   try {
-    const cr = await k8sRequest({ url: k8sUrl(crName.value) });
+    const cr         = await k8sRequest({ url: crUrl(crName.value) });
     const conditions: any[] = cr?.status?.conditions ?? [];
 
-    const available = conditions.find((c: any) => c.type === 'Available');
+    const available   = conditions.find((c: any) => c.type === 'Available');
     const progressing = conditions.find((c: any) => c.type === 'Progressing');
-    const degraded = conditions.find((c: any) => c.type === 'Degraded');
+    const degraded    = conditions.find((c: any) => c.type === 'Degraded');
 
     if (available?.status === 'True') {
       statusMessage.value = available.message || 'Epinio installed successfully.';
@@ -153,11 +559,11 @@ async function poll() {
       statusMessage.value = progressing.message || 'Install is in progress…';
       schedulePoll();
     } else {
-      statusMessage.value = 'Waiting for operator to start…';
+      statusMessage.value = `Waiting for operator to start… (attempt ${ pollCount }/${ POLL_MAX })`;
       schedulePoll();
     }
-  } catch {
-    statusMessage.value = 'Could not reach the cluster — retrying…';
+  } catch (err: any) {
+    statusMessage.value = `Could not reach the cluster (${ extractErrorMessage(err) }) — retrying… (${ pollCount }/${ POLL_MAX })`;
     schedulePoll(8000);
   }
 }
@@ -196,7 +602,7 @@ function close() {
           <LabeledInput
             v-model:value="domain"
             label="Domain"
-            placeholder="e.g. demo.example.test"
+            placeholder="e.g. epinio.192.168.49.2.nip.io"
             :required="true"
             :disabled="busy"
           />
@@ -214,7 +620,7 @@ function close() {
           <LabeledInput
             v-model:value="version"
             label="Version"
-            placeholder="e.g. 1.0.0"
+            placeholder="e.g. 1.13.9"
             :required="true"
             :disabled="busy"
           />
@@ -235,12 +641,58 @@ function close() {
             :class="{ disabled: busy }"
             :disabled="busy"
           >
-            {{ busy ? 'Checking…' : 'Install' }}
+            {{ busy ? 'Working…' : 'Install' }}
           </button>
         </div>
       </form>
     </template>
 
+    <!-- ── BOOTSTRAPPING ── -->
+    <template v-else-if="phase === 'bootstrapping'">
+      <div class="install-dialog__steps">
+        <div
+          v-for="step in bootstrapSteps"
+          :key="step.label"
+          class="install-dialog__step"
+          :class="`install-dialog__step--${ step.status }`"
+        >
+          <span class="install-dialog__step-icon">
+            <i
+              v-if="step.status === 'running'"
+              class="icon icon-spinner icon-spin"
+            />
+            <i
+              v-else-if="step.status === 'done'"
+              class="icon icon-checkmark"
+            />
+            <i
+              v-else-if="step.status === 'skipped'"
+              class="icon icon-minus"
+            />
+            <i
+              v-else
+              class="icon icon-dot-open"
+            />
+          </span>
+          <span>{{ step.label }}</span>
+          <span
+            v-if="step.status === 'running' && bootstrapStep"
+            class="install-dialog__step-detail"
+          >
+            {{ bootstrapStep }}
+          </span>
+        </div>
+      </div>
+      <div class="install-dialog__actions">
+        <button
+          class="btn role-secondary"
+          @click="close"
+        >
+          Close (continues in background)
+        </button>
+      </div>
+    </template>
+
     <!-- ── POLLING / IN PROGRESS ── -->
     <template v-else-if="phase === 'polling'">
       <div class="install-dialog__status">
@@ -296,7 +748,7 @@ function close() {
   padding: 24px;
   display: flex;
   flex-direction: column;
-  min-width: 440px;
+  min-width: 460px;
 
   &__title {
     margin-bottom: 20px;
@@ -311,6 +763,39 @@ function close() {
     flex-direction: column;
   }
 
+  // ── bootstrap steps ──
+  &__steps {
+    display: flex;
+    flex-direction: column;
+    gap: 10px;
+    padding: 8px 0 20px;
+  }
+
+  &__step {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    font-size: 14px;
+    color: var(--body-text-secondary);
+
+    &--running { color: var(--body-text); font-weight: 500; }
+    &--done    { color: var(--success); }
+    &--skipped { color: var(--body-text-secondary); opacity: 0.6; }
+  }
+
+  &__step-icon {
+    width: 18px;
+    text-align: center;
+    flex-shrink: 0;
+  }
+
+  &__step-detail {
+    font-size: 12px;
+    color: var(--body-text-secondary);
+    margin-left: 4px;
+  }
+
+  // ── spinner status ──
   &__status {
     display: flex;
     flex-direction: column;

From 818e6304e5035bcba6e3c41de069c64b9c280db4 Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Tue, 31 Mar 2026 15:41:19 -0400
Subject: [PATCH 27/36] Bump version to v1.13.10-rc3 in package.json

---
 dashboard/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboard/package.json b/dashboard/package.json
index dc15cb0d..9a487405 100644
--- a/dashboard/package.json
+++ b/dashboard/package.json
@@ -1,6 +1,6 @@
 {
   "name": "epinio",
-  "version": "v1.13.10-rc2",
+  "version": "v1.13.10-rc3",
   "engines": {
     "node": ">=20"
   },

From 154b7fd1bbede784a7fffb8b5a963c7775c10f58 Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Tue, 31 Mar 2026 15:41:34 -0400
Subject: [PATCH 28/36] Bump version from 1.13.10-rc2 to 1.13.10-rc3

---
 dashboard/pkg/epinio/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboard/pkg/epinio/package.json b/dashboard/pkg/epinio/package.json
index 90a154f2..ae7f0a58 100644
--- a/dashboard/pkg/epinio/package.json
+++ b/dashboard/pkg/epinio/package.json
@@ -1,7 +1,7 @@
 {
   "name": "epinio",
   "description": "A Rancher Extension of The Application Development Engine for Kubernetes",
-  "version": "1.13.10-rc2",
+  "version": "1.13.10-rc3",
   "private": false,
   "rancher": {
     "annotations": {

From 6efcc0ffcb8a21cbc2ae1b13c0605c29baf514a4 Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Mon, 6 Apr 2026 12:01:50 -0400
Subject: [PATCH 29/36] chore(Cleanup and add automatically update the table
 upon install of epinio):

---
 dashboard/pkg/epinio/dialog/InstallDialog.vue | 157 ++++++++++++++----
 dashboard/pkg/epinio/pages/index.vue          |  15 +-
 2 files changed, 134 insertions(+), 38 deletions(-)

diff --git a/dashboard/pkg/epinio/dialog/InstallDialog.vue b/dashboard/pkg/epinio/dialog/InstallDialog.vue
index baeabc7e..31ac2c60 100644
--- a/dashboard/pkg/epinio/dialog/InstallDialog.vue
+++ b/dashboard/pkg/epinio/dialog/InstallDialog.vue
@@ -14,39 +14,46 @@ const emit = defineEmits<{
 
 const props = defineProps<{
   cluster: EpinioCluster,
+  onSuccess?: () => void,
 }>();
 
-// ── constants ──────────────────────────────────────────────────────────────
+// constants
 const OPERATOR_NAMESPACE  = 'epinio-system';
-const OPERATOR_IMAGE      = 'ghcr.io/epinio/install-operator:latest';
+const OPERATOR_IMAGE      = 'ghcr.io/epinio/install-operator:v1.0.0';
 const OPERATOR_DEPLOYMENT = 'install-operator-controller-manager';
 const OPERATOR_SA         = 'controller-manager';
 const CR_GROUP            = 'epinio.apps.example.com';
 const CR_VERSION          = 'v1alpha1';
 const CR_PLURAL           = 'installepinios';
 
-// ── form state ─────────────────────────────────────────────────────────────
-const domain          = ref('');
-const targetNamespace = ref('epinio');
-const version         = ref('');
-
-// ── page state ─────────────────────────────────────────────────────────────
+// form state
+const domain                     = ref('');
+const targetNamespace            = ref('epinio');
+const version                    = ref('');
+const useExistingIngress         = ref(false);
+const nginxReleaseName           = ref('');
+const nginxReleaseNamespace      = ref('');
+const useExistingCertManager     = ref(false);
+const certManagerReleaseName     = ref('');
+const certManagerReleaseNamespace = ref('');
+
+// page state
 type Phase = 'form' | 'bootstrapping' | 'polling' | 'done' | 'failed';
 const phase         = ref<Phase>('form');
 const busy          = ref(false);
 const errors        = ref<string[]>([]);
 const bootstrapStep = ref('');
 
-// ── steps list for bootstrapping UI ────────────────────────────────────────
+// steps list for bootstrapping UI
 type StepStatus = 'pending' | 'running' | 'done' | 'skipped';
 interface BootstrapStep { label: string; status: StepStatus }
 const bootstrapSteps = ref<BootstrapStep[]>([]);
 
-// ── installed CR identity (for polling) ────────────────────────────────────
+// installed CR identity (for polling)
 const crName        = ref('');
 const statusMessage = ref('');
 
-// ── polling ────────────────────────────────────────────────────────────────
+// polling
 let pollTimer: ReturnType<typeof setTimeout> | null = null;
 let pollCount = 0;
 const POLL_MAX = 90; // 90 × 4 s = 6 min max wait for operator
@@ -60,7 +67,7 @@ function stopPolling() {
   }
 }
 
-// ── helpers ────────────────────────────────────────────────────────────────
+// helpers
 const cid = () => props.cluster.id;
 
 function rawUrl(path: string) {
@@ -133,7 +140,7 @@ function completeStep(label: string, skipped = false) {
   if (step) step.status = skipped ? 'skipped' : 'done';
 }
 
-// ── operator bootstrap ─────────────────────────────────────────────────────
+// operator bootstrap
 async function isOperatorDeployed(): Promise<boolean> {
   try {
     const dep = await k8sRequest({ url: rawUrl(`/apis/apps/v1/namespaces/${ OPERATOR_NAMESPACE }/deployments/${ OPERATOR_DEPLOYMENT }`) });
@@ -160,7 +167,7 @@ async function bootstrapOperator(): Promise<void> {
 
   bootstrapSteps.value = steps.map((label) => ({ label, status: 'pending' as StepStatus }));
 
-  // 1 ── check if already deployed
+  // 1 - check if already deployed
   setStep('Check operator');
   const deployed = await isOperatorDeployed();
 
@@ -173,12 +180,12 @@ async function bootstrapOperator(): Promise<void> {
     return;
   }
 
-  // 2 ── namespace
+  // 2 - namespace
   setStep('Create namespace');
   await ensureOperatorNamespace();
   completeStep('Create namespace');
 
-  // 3 ── CRD
+  // 3 - CRD
   setStep('Register CRD');
   await applyResource(
     rawUrl('/apis/apiextensions.k8s.io/v1/customresourcedefinitions'),
@@ -214,6 +221,10 @@ async function bootstrapOperator(): Promise<void> {
                     domain:          { type: 'string' },
                     targetNamespace: { type: 'string' },
                     version:         { type: 'string' },
+                    nginxReleaseName:            { type: 'string' },
+                    nginxReleaseNamespace:        { type: 'string' },
+                    certManagerReleaseName:      { type: 'string' },
+                    certManagerReleaseNamespace: { type: 'string' },
                     imagePullSecret:          { type: 'string' },
                     imageRegistry:            { type: 'string' },
                     imageRegistryUsername:    { type: 'string' },
@@ -252,7 +263,7 @@ async function bootstrapOperator(): Promise<void> {
   );
   completeStep('Register CRD');
 
-  // 4 ── ServiceAccount
+  // 4 - ServiceAccount
   setStep('Create ServiceAccount');
   await applyResource(
     rawUrl(`/api/v1/namespaces/${ OPERATOR_NAMESPACE }/serviceaccounts`),
@@ -260,7 +271,7 @@ async function bootstrapOperator(): Promise<void> {
   );
   completeStep('Create ServiceAccount');
 
-  // 5 ── RBAC
+  // 5 - RBAC
   setStep('Configure RBAC');
   // Manager ClusterRole
   await applyResource(
@@ -394,7 +405,7 @@ async function bootstrapOperator(): Promise<void> {
   );
   completeStep('Deploy operator');
 
-  // 7 ── wait for pod ready
+  // 7 - wait for pod ready
   setStep('Wait for operator');
   await waitForDeploymentReady();
   completeStep('Wait for operator');
@@ -430,7 +441,7 @@ async function waitForCRDReady(): Promise<void> {
   }
 }
 
-// ── ensure namespace ────────────────────────────────────────────────────────
+// ensure namespace
 async function ensureOperatorNamespace(): Promise<void> {
   try {
     await k8sRequest({ url: rawUrl(`/api/v1/namespaces/${ OPERATOR_NAMESPACE }`) });
@@ -450,7 +461,7 @@ async function ensureOperatorNamespace(): Promise<void> {
   }
 }
 
-// ── duplicate check ─────────────────────────────────────────────────────────
+// duplicate check
 async function hasActiveInstall(ns: string): Promise<boolean> {
   try {
     const list  = await k8sRequest({ url: crUrl() });
@@ -469,24 +480,26 @@ async function hasActiveInstall(ns: string): Promise<boolean> {
   }
 }
 
-// ── submit ──────────────────────────────────────────────────────────────────
+// submit
 async function install() {
   errors.value = [];
   if (!domain.value.trim())          errors.value.push('Domain is required');
   if (!targetNamespace.value.trim()) errors.value.push('Target Namespace is required');
   if (!version.value.trim())         errors.value.push('Version is required');
+  if (useExistingIngress.value && !nginxReleaseName.value.trim())      errors.value.push('Nginx Release Name is required when using an existing ingress');
+  if (useExistingCertManager.value && !certManagerReleaseName.value.trim()) errors.value.push('Cert Manager Release Name is required when using an existing cert-manager');
   if (errors.value.length) return;
 
   busy.value = true;
   try {
-    // Step A — bootstrap operator if not present
+    // Step A - bootstrap operator if not present
     await bootstrapOperator();
 
-    // Step B — wait for CRD to be served (after fresh install)
+    // Step B - wait for CRD to be served (after fresh install)
     bootstrapStep.value = 'Verifying CRD availability…';
     await waitForCRDReady();
 
-    // Step C — duplicate guard
+    // Step C - duplicate guard
     const duplicate = await hasActiveInstall(targetNamespace.value.trim());
 
     if (duplicate) {
@@ -508,6 +521,14 @@ async function install() {
           domain:          domain.value.trim(),
           targetNamespace: targetNamespace.value.trim(),
           version:         version.value.trim(),
+          ...(useExistingIngress.value && nginxReleaseName.value.trim() && {
+            nginxReleaseName:       nginxReleaseName.value.trim(),
+            ...(nginxReleaseNamespace.value.trim() && { nginxReleaseNamespace: nginxReleaseNamespace.value.trim() }),
+          }),
+          ...(useExistingCertManager.value && certManagerReleaseName.value.trim() && {
+            certManagerReleaseName:       certManagerReleaseName.value.trim(),
+            ...(certManagerReleaseNamespace.value.trim() && { certManagerReleaseNamespace: certManagerReleaseNamespace.value.trim() }),
+          }),
         },
       },
     });
@@ -525,7 +546,7 @@ async function install() {
   }
 }
 
-// ── polling loop ────────────────────────────────────────────────────────────
+// polling loop
 function schedulePoll(delayMs = 4000) {
   pollCount++;
   if (pollCount > POLL_MAX) {
@@ -551,6 +572,7 @@ async function poll() {
       statusMessage.value = available.message || 'Epinio installed successfully.';
       phase.value = 'done';
       stopPolling();
+      props.onSuccess?.();
     } else if (degraded?.status === 'True') {
       statusMessage.value = degraded.message || 'Install failed.';
       phase.value = 'failed';
@@ -579,8 +601,6 @@ function close() {
     <h4 class="install-dialog__title">
       Install Epinio on <strong>{{ cluster.name }}</strong>
     </h4>
-
-    <!-- ── FORM ── -->
     <template v-if="phase === 'form'">
       <div
         v-if="errors.length"
@@ -626,6 +646,65 @@ function close() {
           />
         </div>
 
+        <div class="mb-10">
+          <label class="install-dialog__checkbox-label">
+            <input
+              v-model="useExistingIngress"
+              type="checkbox"
+              :disabled="busy"
+            />
+            <span>Use existing Nginx Ingress (skip installation)</span>
+          </label>
+        </div>
+        <template v-if="useExistingIngress">
+          <div class="mb-10 install-dialog__indent">
+            <LabeledInput
+              v-model:value="nginxReleaseName"
+              label="Nginx Release Name"
+              placeholder="e.g. rke2-ingress-nginx"
+              :required="true"
+              :disabled="busy"
+            />
+          </div>
+          <div class="mb-20 install-dialog__indent">
+            <LabeledInput
+              v-model:value="nginxReleaseNamespace"
+              label="Nginx Release Namespace"
+              placeholder="defaults to ingress-nginx"
+              :disabled="busy"
+            />
+          </div>
+        </template>
+        <div class="mb-10">
+          <label class="install-dialog__checkbox-label">
+            <input
+              v-model="useExistingCertManager"
+              type="checkbox"
+              :disabled="busy"
+            />
+            <span>Use existing Cert Manager (skip installation)</span>
+          </label>
+        </div>
+        <template v-if="useExistingCertManager">
+          <div class="mb-10 install-dialog__indent">
+            <LabeledInput
+              v-model:value="certManagerReleaseName"
+              label="Cert Manager Release Name"
+              placeholder="e.g. rancher-cert-manager"
+              :required="true"
+              :disabled="busy"
+            />
+          </div>
+          <div class="mb-20 install-dialog__indent">
+            <LabeledInput
+              v-model:value="certManagerReleaseNamespace"
+              label="Cert Manager Release Namespace"
+              placeholder="defaults to cert-manager"
+              :disabled="busy"
+            />
+          </div>
+        </template>
+
         <div class="install-dialog__actions">
           <button
             type="button"
@@ -646,8 +725,6 @@ function close() {
         </div>
       </form>
     </template>
-
-    <!-- ── BOOTSTRAPPING ── -->
     <template v-else-if="phase === 'bootstrapping'">
       <div class="install-dialog__steps">
         <div
@@ -692,8 +769,6 @@ function close() {
         </button>
       </div>
     </template>
-
-    <!-- ── POLLING / IN PROGRESS ── -->
     <template v-else-if="phase === 'polling'">
       <div class="install-dialog__status">
         <i class="icon icon-spinner icon-spin install-dialog__spinner" />
@@ -708,8 +783,6 @@ function close() {
         </button>
       </div>
     </template>
-
-    <!-- ── SUCCESS ── -->
     <template v-else-if="phase === 'done'">
       <Banner
         color="success"
@@ -724,8 +797,6 @@ function close() {
         </button>
       </div>
     </template>
-
-    <!-- ── FAILED ── -->
     <template v-else-if="phase === 'failed'">
       <Banner
         color="error"
@@ -814,6 +885,20 @@ function close() {
     color: var(--primary);
   }
 
+  &__checkbox-label {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    cursor: pointer;
+    font-size: 14px;
+
+    input[type="checkbox"] { cursor: pointer; }
+  }
+
+  &__indent {
+    padding-left: 24px;
+  }
+
   &__actions {
     display: flex;
     justify-content: flex-end;
diff --git a/dashboard/pkg/epinio/pages/index.vue b/dashboard/pkg/epinio/pages/index.vue
index ca2010c7..1431936e 100644
--- a/dashboard/pkg/epinio/pages/index.vue
+++ b/dashboard/pkg/epinio/pages/index.vue
@@ -88,7 +88,18 @@ const rediscover = async (buttonCb: (success: boolean) => void)  => {
 const openInstall = (c: EpinioCluster) => {
   store.dispatch('cluster/promptModal', {
     component:      'InstallDialog',
-    componentProps: { cluster: c },
+    componentProps: {
+      cluster:   c,
+      onSuccess: () => {
+        store.dispatch(
+          `${ EPINIO_MGMT_STORE }/findAll`,
+          { type: EPINIO_TYPES.CLUSTER, opt: { force: true, load: _MERGE } },
+        ).then(() => {
+          clusters.value = store.getters[`${ EPINIO_MGMT_STORE }/all`](EPINIO_TYPES.CLUSTER);
+          clusters.value.forEach((cluster: EpinioCluster) => testCluster(cluster));
+        });
+      },
+    },
   });
 };
 
@@ -268,7 +279,7 @@ const columns: DataTableColumn[] = [
               class="btn btn-sm role-primary"
               @click="openInstall(row)"
             >
-              Install
+              Install Epinio
             </button>
           </div>
         </template>

From f5edcb8f8f23f358341115faef972ed05c9bee76 Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Tue, 7 Apr 2026 09:47:47 -0400
Subject: [PATCH 30/36] chore(bump versions/crd refs for install operator
 support):

---
 dashboard/pkg/epinio/dialog/InstallDialog.vue | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dashboard/pkg/epinio/dialog/InstallDialog.vue b/dashboard/pkg/epinio/dialog/InstallDialog.vue
index 31ac2c60..8bc7623a 100644
--- a/dashboard/pkg/epinio/dialog/InstallDialog.vue
+++ b/dashboard/pkg/epinio/dialog/InstallDialog.vue
@@ -19,10 +19,10 @@ const props = defineProps<{
 
 // constants
 const OPERATOR_NAMESPACE  = 'epinio-system';
-const OPERATOR_IMAGE      = 'ghcr.io/epinio/install-operator:v1.0.0';
+const OPERATOR_IMAGE      = 'ghcr.io/epinio/install-operator:v1.0.1';
 const OPERATOR_DEPLOYMENT = 'install-operator-controller-manager';
 const OPERATOR_SA         = 'controller-manager';
-const CR_GROUP            = 'epinio.apps.example.com';
+const CR_GROUP            = 'epinio.apps.epinio.io';
 const CR_VERSION          = 'v1alpha1';
 const CR_PLURAL           = 'installepinios';
 
@@ -192,7 +192,7 @@ async function bootstrapOperator(): Promise<void> {
     {
       apiVersion: 'apiextensions.k8s.io/v1',
       kind:       'CustomResourceDefinition',
-      metadata:   { name: 'installepinios.epinio.apps.example.com' },
+      metadata:   { name: 'installepinios.epinio.apps.epinio.io' },
       spec:       {
         group: CR_GROUP,
         names: {

From 6ac0780635962a35e732683f6c93a74976bd9b3c Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Tue, 7 Apr 2026 10:19:22 -0400
Subject: [PATCH 31/36] Update data structure in configurations.js

---
 dashboard/pkg/epinio/models/configurations.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboard/pkg/epinio/models/configurations.js b/dashboard/pkg/epinio/models/configurations.js
index fe05ce82..b532b579 100644
--- a/dashboard/pkg/epinio/models/configurations.js
+++ b/dashboard/pkg/epinio/models/configurations.js
@@ -81,7 +81,7 @@ export default class EpinioConfigurationModel extends EpinioNamespacedResource {
         'content-type': 'application/json',
         accept:         'application/json'
       },
-      data: { ...this.data }
+      data: { data: { ...this.data } }
     });
   }
 

From 579ecd07df0833c840420a9dc4b9724a7af01fdc Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Tue, 7 Apr 2026 14:27:57 -0400
Subject: [PATCH 32/36] chore(bump for rc4):

---
 dashboard/package.json            | 2 +-
 dashboard/pkg/epinio/package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dashboard/package.json b/dashboard/package.json
index 9a487405..f2f188ff 100644
--- a/dashboard/package.json
+++ b/dashboard/package.json
@@ -1,6 +1,6 @@
 {
   "name": "epinio",
-  "version": "v1.13.10-rc3",
+  "version": "v1.13.10-rc4",
   "engines": {
     "node": ">=20"
   },
diff --git a/dashboard/pkg/epinio/package.json b/dashboard/pkg/epinio/package.json
index ae7f0a58..d93d8700 100644
--- a/dashboard/pkg/epinio/package.json
+++ b/dashboard/pkg/epinio/package.json
@@ -1,7 +1,7 @@
 {
   "name": "epinio",
   "description": "A Rancher Extension of The Application Development Engine for Kubernetes",
-  "version": "1.13.10-rc3",
+  "version": "1.13.10-rc4",
   "private": false,
   "rancher": {
     "annotations": {

From d348e99560861215a60b0c1805cc3b2ed8d9c334 Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Wed, 8 Apr 2026 10:27:37 -0400
Subject: [PATCH 33/36] fix(The MastHead component was showing twice due to the
 route not having the showListMasthead set to false. ):

---
 dashboard/pkg/epinio/config/epinio.ts        | 13 ++++---
 dashboard/pkg/epinio/list/configurations.vue | 39 ++++++++++++++++++++
 2 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/dashboard/pkg/epinio/config/epinio.ts b/dashboard/pkg/epinio/config/epinio.ts
index b79eb840..85826f8f 100644
--- a/dashboard/pkg/epinio/config/epinio.ts
+++ b/dashboard/pkg/epinio/config/epinio.ts
@@ -139,12 +139,13 @@ export function init($plugin: any, store: any) {
 
   // Configuration resource
   configureType(EPINIO_TYPES.CONFIGURATION, {
-    isCreatable: true,
-    isEditable:  true,
-    isRemovable: true,
-    showState:   false,
-    canYaml:     false,
-    customRoute: createEpinioRoute('c-cluster-resource', { resource: EPINIO_TYPES.CONFIGURATION }),
+    isCreatable:      true,
+    isEditable:       true,
+    isRemovable:      true,
+    showState:        false,
+    canYaml:          false,
+    customRoute:      createEpinioRoute('c-cluster-resource', { resource: EPINIO_TYPES.CONFIGURATION }),
+    showListMasthead: false
   });
 
   // Groups
diff --git a/dashboard/pkg/epinio/list/configurations.vue b/dashboard/pkg/epinio/list/configurations.vue
index 1a1c57a5..fb3f5870 100644
--- a/dashboard/pkg/epinio/list/configurations.vue
+++ b/dashboard/pkg/epinio/list/configurations.vue
@@ -2,20 +2,45 @@
 import DataTable from '../components/tables/DataTable.vue';
 import type { DataTableColumn } from '../components/tables/types';
 import { EPINIO_TYPES } from '../types';
+import { createEpinioRoute } from '../utils/custom-routing';
 import LinkDetail from '@shell/components/formatter/LinkDetail.vue';
 import BadgeStateFormatter from '@shell/components/formatter/BadgeStateFormatter.vue';
+import Masthead from '@shell/components/ResourceList/Masthead';
 
 import { useStore } from 'vuex';
 import { ref, computed, onMounted, onUnmounted } from 'vue';
 import { startPolling, stopPolling } from '../utils/polling';
 
 const store = useStore();
+const t = store.getters['i18n/t'];
 
 defineProps<{ schema: object }>(); // Keep for compatibility
 
+const resource = EPINIO_TYPES.CONFIGURATION;
+
+const createLocation = computed(() =>
+  createEpinioRoute('c-cluster-resource-create', {
+    cluster: store.getters['clusterId'],
+    resource: EPINIO_TYPES.CONFIGURATION,
+  })
+);
+
+// Strict RBAC: only show Create when user has configuration write (hides for view_only)
+const canCreateConfiguration = computed(() => {
+  const can = store.getters['epinio/can'];
+  const perms = store.getters['epinio/permissions']?.();
+
+  if (!can || !perms || Object.keys(perms).length === 0) {
+    return false;
+  }
+
+  return can('configuration_write') || can('configuration');
+});
+
 const pending = ref<boolean>(true);
 
 onMounted(async () => {
+  await store.dispatch('epinio/me');
   store.dispatch(`epinio/findAll`, { type: EPINIO_TYPES.APP });
   store.dispatch(`epinio/findAll`, { type: EPINIO_TYPES.SERVICE_INSTANCE });
   await store.dispatch(`epinio/findAll`, { type: EPINIO_TYPES.CONFIGURATION });
@@ -76,6 +101,20 @@ const columns: DataTableColumn[] = [
 </script>
 
 <template>
+  <Masthead
+    :schema="schema"
+    :resource="resource"
+  >
+    <template #createButton>
+      <button
+        v-if="canCreateConfiguration"
+        class="btn role-primary"
+        @click="store.$router.push(createLocation)"
+      >
+        {{ t('generic.create') }}
+      </button>
+    </template>
+  </Masthead>
   <DataTable
     :rows="rows"
     :columns="columns"

From 0e34acd4fa7442ba5ae18ab4c0ba1ad9f11d93a7 Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Wed, 8 Apr 2026 10:30:03 -0400
Subject: [PATCH 34/36] chore(bump to rc5):

---
 dashboard/package.json            | 2 +-
 dashboard/pkg/epinio/package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dashboard/package.json b/dashboard/package.json
index f2f188ff..686dabb1 100644
--- a/dashboard/package.json
+++ b/dashboard/package.json
@@ -1,6 +1,6 @@
 {
   "name": "epinio",
-  "version": "v1.13.10-rc4",
+  "version": "v1.13.10-rc5",
   "engines": {
     "node": ">=20"
   },
diff --git a/dashboard/pkg/epinio/package.json b/dashboard/pkg/epinio/package.json
index d93d8700..dab867ef 100644
--- a/dashboard/pkg/epinio/package.json
+++ b/dashboard/pkg/epinio/package.json
@@ -1,7 +1,7 @@
 {
   "name": "epinio",
   "description": "A Rancher Extension of The Application Development Engine for Kubernetes",
-  "version": "1.13.10-rc4",
+  "version": "1.13.10-rc5",
   "private": false,
   "rancher": {
     "annotations": {

From 181f10bb389ef3401cb8b63c0fe1c100422eb2cd Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Wed, 8 Apr 2026 11:21:28 -0400
Subject: [PATCH 35/36] fix(cleanup missed merge conflict):

---
 dashboard/pkg/epinio/config/epinio.ts | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/dashboard/pkg/epinio/config/epinio.ts b/dashboard/pkg/epinio/config/epinio.ts
index 12d300db..de30b327 100644
--- a/dashboard/pkg/epinio/config/epinio.ts
+++ b/dashboard/pkg/epinio/config/epinio.ts
@@ -139,15 +139,6 @@ export function init($plugin: any, store: any) {
 
   // Configuration resource (isCreatable: false so shell doesn't show Create; list shows it only when canCreateConfiguration)
   configureType(EPINIO_TYPES.CONFIGURATION, {
-<<<<<<< new-rbac
-    isCreatable: false,
-    isEditable:  true,
-    isRemovable: true,
-    showState:   false,
-    canYaml:     false,
-    customRoute: createEpinioRoute('c-cluster-resource', { resource: EPINIO_TYPES.CONFIGURATION }),
-    showListMasthead: false,
-=======
     isCreatable:      true,
     isEditable:       true,
     isRemovable:      true,
@@ -155,7 +146,6 @@ export function init($plugin: any, store: any) {
     canYaml:          false,
     customRoute:      createEpinioRoute('c-cluster-resource', { resource: EPINIO_TYPES.CONFIGURATION }),
     showListMasthead: false
->>>>>>> development
   });
 
   // Groups

From 5b1acd2756cbff21264f8c8481c70785d2741955 Mon Sep 17 00:00:00 2001
From: David Johnson <dcharles525@gmail.com>
Date: Fri, 10 Apr 2026 11:24:50 -0400
Subject: [PATCH 36/36] chore(bump for full release):

---
 dashboard/package.json            | 2 +-
 dashboard/pkg/epinio/package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dashboard/package.json b/dashboard/package.json
index 686dabb1..2285e7d9 100644
--- a/dashboard/package.json
+++ b/dashboard/package.json
@@ -1,6 +1,6 @@
 {
   "name": "epinio",
-  "version": "v1.13.10-rc5",
+  "version": "v1.13.10",
   "engines": {
     "node": ">=20"
   },
diff --git a/dashboard/pkg/epinio/package.json b/dashboard/pkg/epinio/package.json
index dab867ef..185f18ef 100644
--- a/dashboard/pkg/epinio/package.json
+++ b/dashboard/pkg/epinio/package.json
@@ -1,7 +1,7 @@
 {
   "name": "epinio",
   "description": "A Rancher Extension of The Application Development Engine for Kubernetes",
-  "version": "1.13.10-rc5",
+  "version": "1.13.10",
   "private": false,
   "rancher": {
     "annotations": {