argoproj / argoproj/argo-workflows
Surface RBAC permissions errors to UI
- Dominant language
- Go
- Stars
- 17k
- Forks
- 3.7k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 138
Description
# Summary
the UI would show any RBAC errors to the UI user so that its easier to debug mis-configured
RBAC , currently the View Logs page is just blank which leads to the UI user having to debug what
is wrong.
# Use Cases
This would be for the UI experience. Currently when you have a mis-configured RBAC or use a TOKEN that doesn't have the correct privs, you essentially get a blank screen. You then have to wonder what the issue is, why am I getting a blank screen on the View Logs page? The permissions denied error is currently being reported as a Warning in the argo-server log as follows:
```
time="2022-05-13T19:34:43.294Z" level=error msg="pods \"hello-world-zgfrj\" is forbidden: User \"system:serviceaccount:argo:argo\" cannot get resource \"pods/log\" in API group \"\" in the namespace \"argo\"" namespace=argo podName=hello-world-zgfrj workflow=hello-world-zgfrj
```
or
```
ime="2022-05-12T18:44:06.341Z" level=warning msg="finished streaming call with code PermissionDenied" error="rpc error: code = PermissionDenied desc = unknown (get pods)" grpc.code=PermissionDenied grpc.method=WorkflowLogs grpc.service=workflow.WorkflowService grpc.start_time="2022-05-12T18:44:06Z" grpc.time_ms=4.619 span.kind=server system=grpc
```
This can be recreated if you get a TOKEN using a ServiceAccount that doesn't have the required privs (GET/LIST pods/log).
---
**Message from the maintainers**:
Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.
Contributor guide
Research direction
Start by tracing the View Logs page and the WorkflowLogs path that reports PermissionDenied for missing pods/log permissions. Done means a UI user sees a useful RBAC or permission error instead of a blank page when the request is denied.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- authorization, backend, frontend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100