Adapt UI for feature flag to disable Kubectl cluster shell

[mallardduck]

Is your feature request related to a problem? Please describe.

Yes - some users feel Rancher Shell feature poses security risk and wish to disable it.
Rancher issue here: rancher/rancher#54957

Describe the solution you'd like

The Rancher Shell buttons should be hidden if the Shell feature is disabled.
(Note this doesn't affect SSH shell links/buttons related to provisioning clusters/nodes)

Describe alternatives you've considered

Dashboard could instead provide a different tooltip when disabled but leave the button.

[github-actions]

🎯 Agentic Issue Triage

Summary: This feature request asks the Dashboard UI to gracefully handle a Rancher feature flag that disables the Kubectl cluster shell — specifically, showing an appropriate "disabled" tooltip (or hiding the button) instead of the current keyboard-shortcut tooltip when the shell is unavailable due to an admin-level feature flag.

Upstream tracking issue in rancher/rancher: rancher/rancher#54957

---

📍 Affected Code Areas

Primary file: shell/components/nav/Header.vue

Key computed properties:

• shellEnabled() — returns !!this.currentCluster?.links?.shell (line ~150). This will be false when the feature flag disables shell, because the backend will not expose the shell link.
• showKubeShell() — returns !this.rootProduct?.hideKubeShell (line ~154). Controls visibility.

The button (line ~627–640):

<button
  v-if="showKubeShell"
  v-clean-tooltip="t('nav.shellShortcut', {key: shellShortcut})"
  :disabled="!shellEnabled"
  ...
>

When shellEnabled is false, the button is rendered as disabled but the tooltip still says "Kubectl Shell (Ctrl+`)" — providing no context to the user as to why it is disabled.

Secondary file: shell/models/management.cattle.io.cluster.js

The _availableActions getter also uses enabled: !!this.links.shell (line ~65) for the cluster context menu action openShell. The same tooltip/disable logic applies there.

i18n: shell/assets/translations/en-us.yaml
Currently has: shell: Kubectl Shell and shellShortcut: Kubectl Shell {key}. A new key (e.g., shellDisabledByAdmin) would be needed.

🛠️ Implementation Approaches

Option A — Descriptive disabled tooltip (preferred per issue description):

1. Add a new i18n key in en-us.yaml, e.g.:

   shellDisabled: Kubectl Shell is disabled by an administrator

2. In Header.vue, use a conditional tooltip:

   v-clean-tooltip="shellEnabled
     ? t('nav.shellShortcut', {key: shellShortcut})
     : t('nav.shellDisabled')"

3. Consider also differentiating between "cluster not ready" (no links.shell because cluster is not active) vs "admin disabled via feature flag". The feature flag could be checked separately using the features store.

Option B — Hide the button when disabled by feature flag:

• Change showKubeShell to also check for the feature flag being active.
• Simpler, but provides less transparency to users.

Recommended approach: A hybrid — show the button as disabled with an explanatory tooltip when the feature flag disables shell. Hide the button only when hideKubeShell is set on the product.

🔍 Debugging / Investigation Steps

1. Confirm how the backend exposes the feature flag: does it remove links.shell from the cluster object, or is there a separate feature flag field accessible in the store?

   • Check shell/store/features.ts for any existing shell-related feature constants.
   • Check if the Rancher API adds a specific annotation/field when shell is disabled.

2. Determine whether shellEnabled returning false is always due to the feature flag, or can also indicate an unready cluster (e.g., cluster still provisioning).

   • If both cases exist, the tooltip should distinguish between them (e.g., "Cluster not ready" vs "Shell disabled by administrator").

3. The _availableActions in management.cattle.io.cluster.js should likely be updated consistently — either hiding or showing with a tooltip field when the action is disabled.

✅ Suggested Sub-tasks

• Investigate how the Rancher backend signals that the kubectl shell feature flag is disabled (API shape change, feature flag store, etc.)
• Add i18n key(s) for the disabled-shell tooltip message
• Update shellEnabled logic in Header.vue to distinguish between "not ready" and "admin disabled"
• Update the v-clean-tooltip binding on the kubectl shell button to show context-aware message
• Update _availableActions in management.cattle.io.cluster.js to handle the disabled state consistently
• Add/update unit tests in shell/components/__tests__/ for the Header component
• Verify with the Rancher backend when the upstream feature flag implementation lands (rancher/rancher#54957)

📚 Relevant Resources

• Upstream feature flag tracking: [RFE] Add feature flag to disable Kubectl cluster shell rancher#54957
• v-clean-tooltip directive: shell/directives/clean-tooltip.ts — supports simple HTML via purifyHTML
• Header component: shell/components/nav/Header.vue
• Cluster model: shell/models/management.cattle.io.cluster.js
• Features store: shell/store/features.ts
• i18n translations: shell/assets/translations/en-us.yaml

Generated by Agentic Triage for issue #17516 · ● 432.7K · ◷

[github-actions]

🤖 Issue grooming questions

This feature request has a clear problem statement and a user flow, but is missing some technical details that engineers need to scope the work:

1. Which specific UI components / locations show Shell buttons? For example: the cluster list action menu, the cluster detail page header, the kubectl shell button in the nav bar, etc. Knowing the full set of affected touch-points helps define the scope and write testable acceptance criteria.

2. How is the feature flag surfaced in the dashboard? What is the flag's name/identifier? Is it exposed via a Rancher setting (e.g. management.cattle.io/v1 Setting), a feature-flags API, or another mechanism? Does the dashboard already read it anywhere, or does new API consumption need to be added?

This comment was generated automatically to help gather the information needed to groom this issue.

Note

🔒 Integrity filter blocked 13 items

The following items were blocked because they don't meet the GitHub integrity level.

• UI incorrectly displays Active state for harvester provisioning cluster #17291 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Project Network Isolation toggle is visible and editable for RKE2 local clusters #17530 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [.backport v2.14.2] Previously set add on values are not preserved on cluster view and edit #17527 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [.backport v2.13.6] Previously set add on values are not preserved on cluster view and edit #17526 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Resource list pages empty themselves after quickly navigating back from detail page #17524 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [BUG] [api-ui] bootstrap 3.4.1 is EoL and contains known CVEs #17505 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [Fleet UI] Fleet Clusters page: Fleet workspace toggle button shows fleet-local instead of fleet-default when navigating back to the same page. #17425 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [BUG] Initial setup rejects valid server URL as invalid #17446 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [backport v2.14.2] Installed Apps, Edit/Upgrade failed to show the installed Helm Chart version #17376 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Units mismatch for ClusterRepo refreshInterval #16852 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Edit and Save causes Deployment list to appear empty when namespace filter is active #16794 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• local-filter in PaginatedResourceTable does not work when switch the filter options which have the same amount of the record #15576 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Duplicate Machine Pool Names are not caught when saving a v2prov cluster  #5211 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Daily Issue Grooming · ● 440.8K · ◷

[richard-cox]

More in the linked PR, but we should hide rather than disable

[github-actions]

🤖 Issue grooming questions

Thanks for the additional direction, @richard-cox — the clarification that buttons should be hidden (not just disabled) is helpful. However, the issue body still needs a couple of details before an engineer can fully scope the work:

1. Which specific UI locations show Shell buttons? For example: the nav bar kubectl shell button, the cluster list action menu, the cluster detail page, etc. Listing the full set of affected touch-points will let us write testable acceptance criteria and ensure nothing is missed.

2. How is the feature flag surfaced in the dashboard? What is the flag's name or identifier? Is it exposed via a Rancher Setting, a feature-flags API endpoint, or another mechanism? Does the dashboard already consume it anywhere, or does new API consumption need to be added?

Could you (or @mallardduck) update the issue body with this information? If the linked PR already covers these points, a direct link to it here would also help.

This comment was generated automatically to help gather the information needed to groom this issue.

Note

🔒 Integrity filter blocked 10 items

The following items were blocked because they don't meet the GitHub integrity level.

• [backport v2.14.2] [FLEET] Label doesnt show on Cluster List properly #17573 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [backport v2.11.14] Refreshing the project membership page assigns wrong role to a member #17566 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• UI -- Resources column not displaying values in Fleet App Bundles section #17563 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• When provisioning a CAPA downstream cluster on a dual-stack Rancher, the architecture does not display in Cluster Management #17555 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [backport v2.14.2] [BUG] RKE2 Cluster Template reuses previous cluster state instead of creating a new cluster #17251 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [backport v2.14.2] [BUG] No option to create new release for same chart #16927 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Units mismatch for ClusterRepo refreshInterval #16852 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Cluster can be explored before it is ready #15873 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• SSP: Cluster List: User is unable to filter on Provider when SSP enabled #13823 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• SSP Home Page: Cluster List: User is unable to filter on k8s version when SSP enabled #13791 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Daily Issue Grooming · ● 290.8K · ◷