Merge pull request #17612 from a110605/hide_harvester_manager

Hide import and manage actions for standard user in Virtualization Management page

Author: a110605

pkg/harvester-manager/list/harvesterhci.io.management.cluster.vue

@@ -205,12 +205,6 @@ export default {
       };
     },
 
-    canCreateCluster() {
-      const schema = this.$store.getters['management/schemaFor'](CAPI.RANCHER_CLUSTER);
-
-      return !!schema?.collectionMethods.find((x) => x.toLowerCase() === 'post');
-    },
-
     rows() {
       return this.hciClusters
         .filter((c) => {
@@ -402,7 +396,7 @@ export default {
         </template>
 
         <template
-          v-if="canCreateCluster"
+          v-if="canCreateAndManageCluster"
           #extraActions
         >
           <router-link
@@ -445,7 +439,7 @@ export default {
         <template #cell:harvester="{row}">
           <button
             class="btn btn-sm role-primary"
-            :disabled="!row.isSupportedHarvester"
+            :disabled="!row.isSupportedHarvester || !row.canCreateAndManageCluster"
             @click="$router.push(row.detailLocation)"
           >
             {{ t('harvesterManager.manage') }}

pkg/harvester-manager/models/harvesterhci.io.management.cluster.js

@@ -1,8 +1,7 @@
 import ProvCluster from '@shell/models/provisioning.cattle.io.cluster';
-import { DEFAULT_WORKSPACE, HCI } from '@shell/config/types';
+import { DEFAULT_WORKSPACE, HCI, MANAGEMENT, CAPI } from '@shell/config/types';
 import { HARVESTER_NAME as VIRTUAL } from '@shell/config/features';
 import { colorForState, stateDisplay, STATES_ENUM } from '@shell/plugins/dashboard-store/resource-class';
-
 export default class HciCluster extends ProvCluster {
   get isSupportedHarvester() {
     return this._isSupportedHarvester === undefined ? true : this._isSupportedHarvester;
@@ -44,6 +43,13 @@ export default class HciCluster extends ProvCluster {
   // We do not allow users to edit Harvester clusters from Cluster Management, so we need to re-enable that action here.
   get _availableActions() {
     const out = super._availableActions;
+
+    if (!this.canCreateAndManageCluster) {
+      const allowActions = ['goToViewYaml', 'download', 'viewInApi'];
+
+      return out.filter((action) => allowActions.includes(action.action));
+    }
+
     const edit = out.find((action) => action.action === 'goToEdit');
 
     if (edit) {
@@ -53,6 +59,17 @@ export default class HciCluster extends ProvCluster {
     return out;
   }
 
+  get canCreateAndManageCluster() {
+    // we check MANAGEMENT.CLUSTER (management.cattle.io.cluster) to avoid standard user role to create or manage the harvester clusters.
+    const mgmtClusterSchema = this.$rootGetters['management/schemaFor'](MANAGEMENT.CLUSTER);
+    const schema = this.$rootGetters['management/schemaFor'](CAPI.RANCHER_CLUSTER);
+
+    const mgmtClusterCreate = !!mgmtClusterSchema?.collectionMethods?.find((x) => x.toLowerCase() === 'post');
+    const clusterCreate = !!schema?.collectionMethods?.find((x) => x.toLowerCase() === 'post');
+
+    return clusterCreate && mgmtClusterCreate;
+  }
+
   get stateColor() {
     if (!this.isSupportedHarvester) {
       return colorForState(STATES_ENUM.DENIED);
@@ -98,7 +115,8 @@ export default class HciCluster extends ProvCluster {
   }
 
   get disableResourceDetailDrawerConfigTab() {
-    return false;
+    // if user is not allowed to create or manage the cluster, we will disable the edit config tab in resource detail drawer.
+    return !this.canCreateAndManageCluster;
   }
 
   get fullDetailPageOverride() {