Rancher master-head commit 4d18400
Addressing 4 enhancement in this ticket, updated to reflect current state of ticket after splitting
- Create an rke2 node driver 1 worker ,1cp, 1 etcd cluster from explorer.
- Create standard users - user1, user2, user3, user4, user5
- Create a project P1
- Add user1 as project owner in P1, user2 as project member in P1 and user3 as read-only
Enhancement 1 (disregard here, now tracked in #3344):
- Login as user1 and create a project in the cluster
- Only the create button says 'Error' but no error message is displayed on the UI.
- When project owners or project members create a project in the cluster, an error should be displayed to the users.
reference from ember UI:
projects.management.cattle.io is forbidden: User "u-7g8s9" cannot create resource "projects" in API group "management.cattle.io" in the namespace "c-m-593a381b"
Enhancement2 (the sole focus of this ticket):
- For user1, the RBAC option in the cluster is show with roles and role-bindings only
- For user2, the RBAC option in the cluster is shown with cluster members only but no members in it
- The RBAC option can be completely hidden from the project owner, project members, read-only and custom project permissions.
Enhancement3 (not possible):
- Log in as user3 to the rancher server.
- Create a namespace as user3.
- Following is the error displayed for user3:
Method POST not supported
- Error message can be changed to
projects.management.cattle.io is forbidden: User "u-7g8s9" cannot create resource "projects" in API group "management.cattle.io" in the namespace "c-m-593a381b for more clear understanding.
Enhancement4 (not possible):
- For user1, user2, user3 - cluster Explorer --> More Resources --> core --> Secrets are visible.
- These can be hidden from the users and need not be shown
reference ticket: #2673
Rancher master-head commit 4d18400
Addressing 4 enhancement in this ticket, updated to reflect current state of ticket after splitting
Enhancement 1 (disregard here, now tracked in #3344):
reference from ember UI:
projects.management.cattle.io is forbidden: User "u-7g8s9" cannot create resource "projects" in API group "management.cattle.io" in the namespace "c-m-593a381b"Enhancement2 (the sole focus of this ticket):
Enhancement3 (not possible):
Method POST not supportedprojects.management.cattle.io is forbidden: User "u-7g8s9" cannot create resource "projects" in API group "management.cattle.io" in the namespace "c-m-593a381bfor more clear understanding.Enhancement4 (not possible):
reference ticket: #2673