Actions that cannot be performed by a Cluster member are available on an RKE1 cluster in a rancher setup when RKE2 flag is disabled

[sowmyav27]

On 2.6-head commit id: b43e4d9

Actions that cannot be performed by a Cluster member are available on an RKE1 cluster in a rancher setup when RKE2 flag is disabled

[gaktive]

Pushing out a version based on time. @sowmyav27 was it all actions or any specific ones?

[gaktive]

Another link to hide, should be simple.

[davidnuzik]

My checks FAILED

Reproduction Environment:

Rancher version: v2.6.0 and also tried v2.6-b43e4d955c8fdbb85bbbba1962937b0abbdf4a09-head image
Rancher cluster type: single-node docker install
Docker version: 20.10

Downstream cluster type: rke1
Downstream K8s version: v1.21.6-rancher1-1

Reproduction steps:

1. Deactivate the RKE2 feature flag.
2. Create a standard user that we will use to be the cluster member user.
3. As the admin, create an RKE1 cluster with any node driver. In my case I used digital ocean. Add the standard user as a cluster member.
4. Logout. Log in as the standard user (cluster member).
5. Under Cluster Management, click on the cluster. Click the vertical "..." aka the function menu for the cluster. Notice we have actions available that the cluster member should not see. The Download Kubeconfig action is available. However, I didn't see the "Take Snapshot" action as an available option.
   

Additionally, if I tried to force UI assets to only use "Local" instead of "Dynamic" I could not see the "Take Snapshot" action as a cluster member.

I could only also see the "Take Snapshot" action if I created a new user and gave them the "Cluster Owner" role, not cluster member. Still -- we can check to confirm that we can no longer see the "Download Kubeconfig" option as a cluster member when I validate.

---

Validation Environment:

Rancher version: v2.6-head 44b8030a0 pulled at 11/23/21 11:03am Arizona time
Rancher cluster type: single-node docker install
Docker version: 20.10

Downstream cluster type: rke1
Downstream K8s version: v1.21.6-rancher1-1

Validation steps:

1. Execute the same steps as indicated above in the Reproduction section. Notice that when we log in as the cluster member now, the situation appears to be worse, actually. I can see the "Take Snapshot" AND the "Download Kubeconfig" actions. Before I could only see the "Take Snapshot" action as a cluster member:

At first I thought this might be some strange browser caching issue or something. I tried to refresh my incognito browser and I still see all these actions as a cluster member (more than before the change). I then completely closed out my incognito browser and opened it again, logged in as the standard user (cluster member) and still saw the same result.

[nwmac]

@davidnuzik What actions are you expecting to see with each user type?

For:

• 'Download Kubeconfig' we check that the cluster has the generateKubeconfig action available
• 'Take Snapshot' - we check that the cluster has the backupEtcd action available

If the visibility of these 2 is the issue, then we will need to transfer this to the backend team to ensure the action metadata is correctly provided for the given user/cluster.

[nwmac]

@sowmyav27 Is there someone who can answer the question on this issue?

[davidnuzik]

@nwmac Here is a comparison if this helps. We should see this (RKE2 feature flag enabled (default) or not actually based on my tests -- I don't think the feature flag matters)

But instead, we see this on RKE1 clusters, however members do not have permission to take snapshots (and restore snapshots) and rotate certs. Snapshot commands and rotating certs should not be shown on RKE1 clusters in the Vue UI when the user is a cluster member.

[nwmac]

@davidnuzik I've checked the UI code - for snapshots, we check for the action backupEtcd, for rotate certificates we check for the action rotateCertificates - so these actions must be being returned by the backend incorrectly for the user.

I will transfer to rancher/rancher for the backend team to have a look to ensure that the actions are returned correctly based on the user's permissions.

[snasovich]

It's possible that controller(s) that should be tied to V2 provisioning flag are controlled by RKE2 flag instead. We may need to switch which flag enables these controllers.

[a-blender]

I reproduced this on a local single node DO RKE1 cluster, with the RKE2 flag both enabled and disabled. Both times I saw the Take Snapshot and Rotate Certificates options available for the standard cluster member (which is incorrect), so it's safe to assume the RKE2 flag is unrelated to this bug.

PR in with fix #35963.

[a-blender]

Testing template

Root cause

A standard cluster member on an RKE1 cluster was seeing options reserved for a cluster admin because the logic in the Norman API on what actions to make permissible to a user was incorrect.

What was fixed, or what changes have occurred

• Updated https://github.com/rancher/rancher/blob/release/v2.6/pkg/api/norman/customization/cluster/actionhandler.go
• Updated logic in

  rancher/pkg/api/norman/customization/cluster/formatter.go

  Line 38 in 1a361b7

  func (f *Formatter) Formatter(request *types.APIContext, resource *types.RawResource) {

Areas or cases that should be tested

1. Create a new user
2. Create an RKE1 downstream cluster with user as a standard cluster member
3. Logout and login as user
4. You should only have access to the downstream cluster. View your cluster and make sure your actions drop down list for the cluster looks like this

What areas could experience regressions ?

Rancher UI actions list for an RKE1 cluster if logic is overwritten.

Are the repro steps accurate/minimal ?

Yes.

[Auston-Ivison-Suse]

Reproduction Setup

• rancher version: v2.6.3
• Downstream cluster: rke1, ec2, k8s: v1.21.9-ranche1-1

Reproduction Steps

1. Create user with standard permissions
2. Login as said user and create downstream cluster
3. Logout and log back in. Check the actions within the kebab menu.

Result

The actions available in the dropdown are not the permissible actions of a standard user.

**Setup For Validation **

• rancher version: v2.6-head(
• Downstream cluster: rke1, ec2, k8s: v1.21.9-ranche1-1

1. Create user with standard permissions
2. Login as said user and create downstream cluster
3. Logout and log back in. Check the actions within the kebab menu.

Results

The correct actions are available.

Screenshot

Reproduction Screenshot:

Validation Screenshot: