Skip to content

Fix/epinio namespace check#541

Open
psanghvi17 wants to merge 5 commits intomainfrom
fix/epinio-namespace-check
Open

Fix/epinio namespace check#541
psanghvi17 wants to merge 5 commits intomainfrom
fix/epinio-namespace-check

Conversation

@psanghvi17
Copy link
Contributor

@psanghvi17 psanghvi17 commented Mar 9, 2026

PR Checklist

  • Linting Test is passing
  • Code is well documented
  • If applicable, a PR in the epinio/docs repository has been opened

Summary

Fixes #
Fixes hardcoded namespace assumptions in the Epinio UI dashboard extension.

Occurred changes and/or fixed issues

  • Modified ui/dashboard/pkg/epinio/index.ts to remove the hardcoded check ctx.metadata.namespace !== 'epinio'.
  • The "Go to Epinio" action button logic now relies solely on Epinio-specific annotations (isPodFromEpinio) rather than excluding specific namespace names.

Technical notes summary

  • Previously, the UI explicitly hid the "Go to Epinio" button if a resource was in the epinio namespace. This logic was brittle and did not account for custom installation namespaces or edge cases where valid Epinio workloads might exist in the installation namespace.
  • The logic is now namespace-agnostic, checking only if the resource (Pod) has the required Epinio annotations to link back to an application.

Areas or cases that should be tested

  1. Custom Namespace Installation:
    • Install Epinio in a custom namespace (e.g., my-custom-ns).
    • Deploy a sample application.
    • Navigate to the Kubernetes Pods list in the Rancher/Epinio dashboard.
    • Locate the pod for the deployed application.
    • Verify that the "Go to Epinio" action button is visible and functional.
  2. Standard Installation (Regression):
    • Install Epinio in the default epinio namespace.
    • Deploy an application.
    • Verify the button still appears correctly for these apps.

Areas which could experience regressions

  • Action Button Visibility: Ensure the button does not start appearing on system components (like Epinio server pods) where it shouldn't, although the isPodFromEpinio annotation check should prevent this.

Screenshot/Video

Introduce client-side RBAC support and apply it across the Epinio dashboard. Add utils/permissions.ts to build a flat permission map from /api/v1/me roles, and new EpinioMe/EpinioRole types. Extend the epinio store with a me action, permissions state, a can getter helper, and related mutations/reset. Fetch /me on relevant pages (namespaces, applications) and conditionally show Create buttons only when appropriate permissions are present (with sensible defaults while permissions are not yet loaded). Update resource models (applications, namespaces, services, configurations) to filter available actions based on the can getter and prune orphaned dividers for application actions. Overall this enforces UI-level RBAC while still relying on the API for authoritative enforcement.
@github-actions github-actions bot added the kind/bug Something isn't working label Mar 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kind/bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant