feat(rbac): allow tenants to start/stop/restart their VMs by kvaps · Pull Request #2777 · cozystack/cozystack

Andrei Kvapil (kvaps) · 2026-06-01T18:43:17Z

Summary

Grants tenant users permission to call the KubeVirt VM power-control subresources (subresources.kubevirt.io → virtualmachines/{name}/start|stop|restart, verb update) by adding them to the cozy:tenant:use:base ClusterRole, which aggregates into tenant-use, tenant-admin, and tenant-super-admin.

Without this, the dashboard VM power buttons return 403 even for tenant admins: kubectl auth can-i update virtualmachines --subresource=start is no for every tenant role today, while virtualmachineinstances/console|vnc|portforward are already granted at the same use level — so power control belongs there too.

Companion PR

UI that consumes this permission (VM power controls + VNC fixes): cozystack/cozystack-ui#27

Test

helm template renders cozy:tenant:use:base with the new virtualmachines/start|stop|restart rule.
After apply, kubectl auth can-i update virtualmachines --subresource=start|stop|restart flips from no to yes for the tenant-*-use/admin/super-admin groups.

Summary by CodeRabbit

New Features
- Virtual Machine Power Control: Users with tenant-level access can now start, stop, and restart virtual machines, providing enhanced management capabilities for VM operations.

coderabbitai · 2026-06-01T18:43:27Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: bddf107a-c584-4027-a96c-4af5b7bf7d3d

📥 Commits

Reviewing files that changed from the base of the PR and between d2bc261 and 8e78add.

📒 Files selected for processing (1)

packages/system/cozystack-basics/templates/clusterroles.yaml

📝 Walkthrough

Walkthrough

This PR extends the tenant "use" RBAC permissions to allow users to invoke KubeVirt VM power control actions. A new policy rule grants update access to the KubeVirt subresources API for virtual machine start, stop, and restart operations.

Changes

VM Power Control RBAC Permissions

Layer / File(s)	Summary
RBAC rule for VM start/stop/restart subresources `packages/system/cozystack-basics/templates/clusterroles.yaml`	ClusterRole `cozystack:tenant:use:base` is extended with a new RBAC rule that grants `update` permission on `subresources.kubevirt.io` API group for `virtualmachines/start`, `virtualmachines/stop`, and `virtualmachines/restart` resources, enabling tenant users to control VM power state.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A cluster role hops into place,
Granting powers—start, stop, restart with grace,
VMs bow to tenant command,
With RBAC rules so finely planned! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and accurately describes the main change: adding RBAC permissions for tenant users to control VM power operations.
Linked Issues check	✅ Passed	The PR fulfills the RBAC requirement stated in linked issue `#27`, granting the necessary permissions for tenant users to call VM power-control subresources.
Out of Scope Changes check	✅ Passed	All changes are scoped to RBAC configuration for VM power controls as required by the linked UI feature PR; no unrelated modifications present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/vm-power-rbac

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Grant the subresources.kubevirt.io virtualmachines/start|stop|restart "update" verb in cozy:tenant:use:base so the dashboard VM power controls work for tenant users (aggregates into admin/super-admin). Without it the actions return 403 even for tenant admins. Co-Authored-By: Claude <[email protected]> Signed-off-by: Andrei Kvapil <[email protected]>

gemini-code-assist · 2026-06-01T19:12:33Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the RBAC configuration to enable power management capabilities for tenant users. By extending the base tenant role, it ensures that users can perform start, stop, and restart operations on their virtual machines, aligning these permissions with existing operational access like console and VNC.

Highlights

RBAC Permissions Update: Added permissions for virtualmachines/start, virtualmachines/stop, and virtualmachines/restart to the cozy:tenant:use:base ClusterRole.
Dashboard Fix: Resolved 403 Forbidden errors encountered by tenant admins when attempting to use VM power controls in the dashboard.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds power controls (start, stop, and restart) for tenant-owned virtual machines to the cluster roles in cozystack-basics, preventing 403 errors on the dashboard. The review feedback notes that the PR title uses an invalid scope (rbac) and the PR description is missing the required release-note block, both of which violate the repository's commit and PR guidelines.

gemini-code-assist · 2026-06-01T19:13:08Z

  verbs:
  - get
  - update
+# Power controls (start/stop/restart) for VMs owned by the tenant.


According to the repository guidelines, the PR and its commits must adhere to specific formatting rules:

Invalid Scope: The scope rbac used in the PR title (feat(rbac): ...) is not a valid scope. It should be a package-specific scope like cozystack-basics or one of the allowed system/apps/meta scopes.

Missing Release Note: The PR body is missing the required release-note block.

Please update the PR title/commits and add the release-note block to the PR description.

References

Each commit must follow Conventional Commits format with valid scopes, and the PR body must contain a release-note block. ^(link)

github-actions Bot added area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review size/L This PR changes 100-499 lines, ignoring generated files kind/feature Categorizes issue or PR as related to a new feature labels Jun 1, 2026

Andrei Kvapil (kvaps) mentioned this pull request Jun 1, 2026

feat(console): VM power controls (start/stop/restart) + VNC fixes cozystack/cozystack-ui#27

Merged

2 of 3 tasks

Andrei Kvapil (kvaps) force-pushed the feat/vm-power-rbac branch from 2e0c644 to 8e78add Compare June 1, 2026 19:07

github-actions Bot added size/S This PR changes 10-29 lines, ignoring generated files and removed size/L This PR changes 100-499 lines, ignoring generated files labels Jun 1, 2026

Andrei Kvapil (kvaps) marked this pull request as ready for review June 1, 2026 19:12

Andrei Kvapil (kvaps) requested review from IvanHunters, Andrey Kolkov (androndo), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners June 1, 2026 19:12

gemini-code-assist Bot reviewed Jun 1, 2026

View reviewed changes

myasnikovdaniil approved these changes Jun 2, 2026

View reviewed changes

Aleksei Sviridkin (lexfrei) merged commit 26da871 into main Jun 2, 2026
13 of 14 checks passed

Aleksei Sviridkin (lexfrei) deleted the feat/vm-power-rbac branch June 2, 2026 21:12

Navigation Menu

Repository navigation

feat(rbac): allow tenants to start/stop/restart their VMs - #2777

feat(rbac): allow tenants to start/stop/restart their VMs#2777
Aleksei Sviridkin (lexfrei) merged 1 commit into
mainfrom
feat/vm-power-rbac

Andrei Kvapil (kvaps) commented Jun 1, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 1, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist Bot commented Jun 1, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jun 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Andrei Kvapil (kvaps) commented Jun 1, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Companion PR

Test

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist Bot commented Jun 1, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Andrei Kvapil (kvaps) commented Jun 1, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 1, 2026 •

edited

Loading