Repository navigation
feat(dashboard): add cluster-usage RBAC for the new admin page - #2743
Conversation
The cluster-usage admin page in the dashboard reads cluster-scoped resources (nodes, pods, metrics.k8s.io) to render aggregate utilisation and a per-node table that includes arbitrary extended resources such as GPUs. The built-in 'edit' ClusterRole already bound to cozystack-cluster-admin via cozystack-dashboard-cluster-admin does not grant cluster-wide pod read or any access to 'nodes', so the dashboard needs an explicit grant for the page to render anything beyond an error. The page-side sidebar item is gated by SelfSubjectAccessReview on 'nodes list' — without this binding the gate fails closed and the entry stays invisible, which is the desired fallback for clusters that have not adopted the new RBAC yet. The chart intentionally does not add permissions for deeper sources (Prometheus, DCGM, HAMi). Those belong in their respective packages or operator-provided RBAC; the page detects them via discovery and gates each section with its own per-source review. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR adds Kubernetes RBAC resources and tests for dashboard cluster usage monitoring. It defines a ChangesDashboard Cluster Usage RBAC
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
area/dashboard
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces the necessary RBAC permissions to support an upcoming dashboard feature for monitoring cluster-wide resource utilization. By granting specific read access to nodes, pods, and metrics, the changes ensure that administrators can view detailed cluster usage data without over-privileging the dashboard service. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new ClusterRole and ClusterRoleBinding to grant the cozystack-dashboard-cluster-usage role read access to cluster-scoped resources (nodes, pods, and metrics.k8s.io) for the dashboard's cluster-usage admin page. It also adds a comprehensive suite of Helm unit tests to verify the correct creation and binding of these RBAC resources. The reviewer suggested adding standard Helm labels to the metadata of both the ClusterRole and ClusterRoleBinding templates to align with best practices for resource tracking and management.
2 participants
What this PR does
Adds a new
ClusterRolecozystack-dashboard-cluster-usageand itsClusterRoleBindingunderpackages/system/dashboard/templates/, plus the matching helm-unittest fixture. The role grants thecozystack-cluster-admingroup cluster-wide read onnodes,pods(get/list/watch) and onmetrics.k8s.ionodes(get/list).Companion to the upcoming UI work in cozystack/cozystack-ui#15 — a new admin page
Console → Administration → Cluster Usagethat renders cluster-scoped resource utilisation and a per-node table including arbitrary extended resources (GPUs and other accelerators). The page-side sidebar item is gated by aSelfSubjectAccessReviewonnodes list; without this binding the gate fails closed and the entry stays invisible, which is the desired fallback for clusters that have not adopted the new RBAC yet.The built-in
editClusterRolealready bound tocozystack-cluster-adminviacozystack-dashboard-cluster-admindoes not grant cluster-wide pod read or any access tonodes, so an explicit grant is required for the page to render anything beyond an error.This chart intentionally does not add permissions for deeper sources (Prometheus, DCGM, HAMi). Those belong in their respective packages or in operator-provided RBAC; the page detects them via discovery and gates each section with its own per-source review.
Screenshots
No UI in this PR — RBAC only.
Release note
Summary by CodeRabbit
New Features
Tests