Menu sub-section VNF and "create kubernetes" showed also if list permission not present

[tanganellilore]

ISSUE TYPE

• Bug Report

COMPONENT NAME

UI

CLOUDSTACK VERSION

4.19.1.0 

CONFIGURATION

OS / ENVIRONMENT

Ubuntu 22.04

SUMMARY

Hi team,
I notice that if I create a role with basic list rules, We need to ad at least "Deny" on
listVnfAppliances and listKubernetesClusters to hide respective section and button.

Probably is required some "if" in vue render of menu and create buttopn like this PR: https://github.com/apache/cloudstack/pull/9237/files

STEPS TO REPRODUCE

1. Create a custom role without vnf or kuberenetes permission, but with network permisison and instance permission (and other basic permission (like user role but without listVpnGateways)
2. Create a Accounts with this rule
3. Add new user to this account
4. Navigate to network section and VNF section is showed
5. Navigate to create button and Kubernets or VNF is showed

EXPECTED RESULTS

ACTUAL RESULTS

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template!

[adietrich-ussignal]

@tanganellilore I believe PR #9237 actually fixed this, which was released in 4.19.1.0. I don't see either option in our roles configured to align to what end users will see. I would look further at the permissions in your roles to make sure you aren't missing one. The amount of permissions is overwhelming, so its very likely there are a few others you will need to set to deny.

[adietrich-ussignal]

Here is an example of what I see on a specifically configured role with VNF and Kubernetes permissions removed.

[tanganellilore]

Thanks for fast answer, I will check better my release because I'm started from new role without any permission.
I notice that there are a lot permission but this allow us to be very granulare.

[shwstppr]

@tanganellilore adding to what @adietrich-ussignal mentioned, if your new role is based on the Default User/DomainAdmin role you may have to set deny for the APIs for which you want to hide the corresponding view.

For hiding the Create button option, create* APIs such as createKubernetesCluster needs to be set to Deny.

For hiding the whole section in the left pane, you will have to set Deny for the corresponding list* API.