cockroachdb / cockroachdb/cockroach
clusters settings: allow VIEWACTIVITY and VIEWACTIVITYREDACTED roles to see console only settings
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
Currently, the /_admin/v1/settings API has logic to allow users with VIEWACTIVITY and VIEWACTIVITYREDACTED roles to see a subset of cluster settings, as they pertain to db-console. Under the hood, this API queries `crdb_internal.cluster_settings`, but this is only queryable for users with VIEWCLUSTERSETTINGS and MODIFYCLUSTERSETTINGS roles.
We should update the `crdb_internal.cluster_settings` VTable and `SHOW CLUSTER SETTINGS` builtin to allow users with VIEWACTIVITY and VIEWACTIVITYREDACTED roles to query these tables / builtins and limit the results to those defined in: https://github.com/cockroachdb/cockroach/blob/8cdb3b57a13e31346fef92d80c46b4e2e1446956/pkg/settings/registry.go#L398
Once this is done, the custom logic in admin.go#Settings() should be removed
Jira issue: CRDB-46577
Contributor guide
Assessment
This issue has not been assessed yet.