[BUG] with OIDC login, the GUI intially shows an empty list of clusters (2.14.x)

[tmmorin]

Rancher Server Setup

• Rancher version: 2.14.0 (seen also with 2.14.1)
• Installation option (Docker install/Helm Chart): Helm chart
  • If Helm Chart, Kubernetes Cluster and version (RKE1, RKE2, k3s, EKS, etc): RKE2 1.35 (also seen on 1.34)

Information about the Cluster

• Kubernetes version: 1.35 (also seen with 1.34)
• on-premise (OpenStack and metal3)

User Information

• What is the role of the user logged in? (Admin/Cluster Owner/Cluster Member/Project Owner/Project Member/Custom) happens with both an Admin user and a Cluster Member

Describe the bug

When logging into Rancher with OIDC (Keycloak), the initial list of clusters shown in the landing page (/dashboard/home) is empty.

When reloading after some time, the actual list of clusters finally ends up showing up.

Sometimes reloading after 20-30s is sufficient to have the clusters be listed.
Sometimes it can take as much as 5 minutes to have the list.

To Reproduce

• configure Rancher with OIDC login
• log into Rancher with OIDC login, as any user (bug observed with both Admin and Cluster Member)

Result

No cluster appears in the list of clusters.

Expected Result

Cluster should appear in this list without having wait and reload the page.

Screenshots

Intial page right after logging in:

Same page after waiting for a few minutes and reloading the page:

Additional context

• This issue was observed only with an OIDC login. Logging in with the local admin user does not trigger the problem
• After waiting+reloading to get the list of clusters, doing a logout and re-logging in again gets us again an empty list of clusters

References

• SUSE Case 01838736 (has HAR files)
• SURE-11615
• Bug tracked in the project where we hit this: https://gitlab.com/sylva-projects/sylva-core/-/work_items/4003

[richard-cox]

@tmmorin Just waiting on some internal processes and we'll then send over some questions

[tmmorin]

One of our colleagues, Bogdan Antohe, did the work of comparing our Rancher/Keycloak OIDC setup with the official Rancher documentation, and noticed discrepancies.

After fixing those discrepancies, the GUI bug does not occur anymore.

Details here: https://gitlab.com/sylva-projects/sylva-core/-/merge_requests/7890

It remains surprising that:

• those discrepancies don't create any problem with Rancher < 2.14
• those discrepancies result in a GUI side-effect that goes away if we reload the page after a few minutes