argoproj / argoproj/argo-workflows

Surface RBAC permissions errors to UI

Open
#8,760 0 comments 11 reactions 0 assignees View on GitHub
area/sso-rbac area/ui
Dominant language
Go
Stars
17k
Forks
3.7k
Avg merge
1d 20h
Merged PRs (30d)
138

Description

# Summary

the UI would show any RBAC errors to the UI user so that its easier to debug mis-configured
RBAC , currently the View Logs page is just blank which leads to the UI user having to debug what
is wrong.

# Use Cases

This would be for the UI experience. Currently when you have a mis-configured RBAC or use a TOKEN that doesn't have the correct privs, you essentially get a blank screen. You then have to wonder what the issue is, why am I getting a blank screen on the View Logs page? The permissions denied error is currently being reported as a Warning in the argo-server log as follows:
```
time="2022-05-13T19:34:43.294Z" level=error msg="pods \"hello-world-zgfrj\" is forbidden: User \"system:serviceaccount:argo:argo\" cannot get resource \"pods/log\" in API group \"\" in the namespace \"argo\"" namespace=argo podName=hello-world-zgfrj workflow=hello-world-zgfrj
```
or
```

ime="2022-05-12T18:44:06.341Z" level=warning msg="finished streaming call with code PermissionDenied" error="rpc error: code = PermissionDenied desc = unknown (get pods)" grpc.code=PermissionDenied grpc.method=WorkflowLogs grpc.service=workflow.WorkflowService grpc.start_time="2022-05-12T18:44:06Z" grpc.time_ms=4.619 span.kind=server system=grpc
```

This can be recreated if you get a TOKEN using a ServiceAccount that doesn't have the required privs (GET/LIST pods/log).

---

**Message from the maintainers**:

Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the View Logs page and the WorkflowLogs path that reports PermissionDenied for missing pods/log permissions. Done means a UI user sees a useful RBAC or permission error instead of a blank page when the request is denied.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
authorization, backend, frontend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.