Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

[UI] Edit and delete options for backup schedules should be disabled if the user does not have the permission

Description

Tested with Everest v1.2.0-rc1 version.

Install mysql operator in a1 namespace and mongodb in a2 namespace.

Login in Everest UI using admin user and create mysql database using the admin user. Take some scheduled backups for the mysql database.

Create a user dbadmin using cli.

Add the following permissions in the RBAC policy

Access the mysql backups in a1 namespace and try to edit the backup schedule

Clicking the Save button does not do anything.

Try to delete the backup schedule

Clicking the Delete button does not do anything.

If the user does not have the permissions to edit/delete the backup schedule, then we should disable the edit/delete buttons below and not allow the user to proceed ahead for editing/deleting schedules

Environment

None

Attachments

9

Activity

Show:

Manish Chawla November 13, 2024 at 9:21 AM

Tested with Everest v1.3.0-rc4 version.

Installed mysql operator in a1 namespace and mongodb, pg operator in a2 namespace.

Create a mysql database in a1 namespace and mongodb, pg databases in a2 namespace.

Create a user dbadmin using cli.

Add the following permissions for dbadmin in configmap

Login in Everest UI as dbadmin and access the mysql database in a1 namespace, the edit/delete buttons are not displayed

Now try to edit/delete the backup schedule of a database in a2 namespace

The dbadmin user can create, edit and delete the backup schedules of databases in a2 namespace.

Now change the permissions for dbadmin in configmap to give read permissions for backups in a1 namespace

The dbadmin user can view the backups and schedules of databases in a1 namespace

The dbadmin user can also view the backup schedules of databases in a2 namespace

Manish Chawla November 12, 2024 at 11:04 AM

Tested with Everest v1.3.0-rc3 version.

Installed mysql operator in a1 namespace and mongodb, pg operator in a2 namespace.

Create a mysql database in a1 namespace and mongodb, pg databases in a2 namespace.

Create a user dbadmin using cli.

Add the following permissions for dbadmin in configmap

Now access the mysql database in a1 namespace, the edit/delete buttons are not displayed

Now try to edit/delete the backup schedule of a database in a2 namespace

The edit/delete buttons are still disabled. This is an issue because the dbadmin user has the permissions to edit/delete the schedules in a2 namespace.

Manish Chawla September 11, 2024 at 6:09 AM
Edited

Another scenario is when the dbadmin user has read permissions in a1 namespace

The dbadmin user can try to edit/delete backups in a1 namespace. The edit/delete buttons should be disabled for read permissions.

Unresolved

Details

Assignee

Reporter

Fix versions

Affects versions

Priority

Smart Checklist

Created September 10, 2024 at 1:29 PM
Updated November 18, 2024 at 12:45 PM