Skip to content

Only apply os/arch restriction to rancher repos#17352

Merged
momesgin merged 11 commits into
rancher:masterfrom
momesgin:11670-charts-os-restriction
May 21, 2026
Merged

Only apply os/arch restriction to rancher repos#17352
momesgin merged 11 commits into
rancher:masterfrom
momesgin:11670-charts-os-restriction

Conversation

@momesgin
Copy link
Copy Markdown
Member

@momesgin momesgin commented Apr 23, 2026

Summary

Fixes #11670

This PR updates the chart installation logic to only apply the default linux OS restriction if the chart originates from an official Rancher repository. This prevents external charts without catalog.cattle.io/permits-os annotations from being incorrectly blocked from installation on Windows nodes.

Occurred changes and/or fixed issues

  • Modified the repository identification logic to accurately detect Rancher repositories, specifically adding support for airgapped environments where the registry URL does not end in .rancher.io.
  • Updated compatibleVersionsFor to only fall back to linux when evaluating permitted OS if the chart is from an official Rancher repository.
  • Updated windowsIncompatible logic in the chart install page and chart mixin to use the new shared isRancherRepo helper and only apply the fallback to official Rancher repositories.

Technical notes summary

  • Created a shared isRancherRepo(repo, chart) helper function in shell/store/catalog.js to centralize the logic for detecting official Rancher repositories.
  • The isRancherRepo helper checks if the repository is natively identified as a Rancher source or if it's an airgapped repository (specifically, a ClusterRepo named rancher-charts or rancher-partner-charts). By verifying CATALOG.CLUSTER_REPO, we ensure standard users cannot spoof official repositories within namespace-scoped repos.
  • Added comprehensive unit tests for isRancherRepo and compatibleVersionsFor to ensure correct behavior across different repository types and OS constraints.

Areas or cases that should be tested

  • External charts on Windows clusters: Verify that installing a 3rd-party chart (not from a Rancher repo) without the catalog.cattle.io/permits-os annotation is permitted on clusters with Windows nodes and does not show the "Windows Incompatible" warning.
  • Rancher charts on Windows clusters: Verify that official Rancher charts without the OS annotation are still restricted to Linux and correctly show the "Windows Incompatible" warning on Windows clusters.
  • Airgap environments: Verify that in an airgapped setup where the rancher-charts repository URL is modified to an internal registry, Rancher charts are still correctly identified as official and default to Linux if no OS annotation is present.

Areas which could experience regressions

  • Chart installation and version selection for both official Rancher charts and third-party charts.
  • Display of "Windows Incompatible" and "Linux Only" warnings in the Apps & Marketplace catalog and installation workflows.
  • Repository parsing and identification in airgapped environments.

Screenshot/Video

I've mocked the workerOs getter in order to test this:
shell/models/management.cattle.io.cluster.js:

  get workerOSs() {
    return ['windows', 'linux'];
  }

then I've added the permit os annotation catalog.cattle.io/permits-os to my dummy chart's different versions to test different cases:
version 0.1.0 > no annotation
version 0.2.0 > catalog.cattle.io/permits-os: "linux"
version 0.3.0 > catalog.cattle.io/permits-os: "linux,windows"

image

here's my repo's URL https://momesgin.github.io/mo-charts/ in case you need to use it.

now let's compare before an after based on these mocked data,
BEFORE:
version 0.1.0
image

version 0.2.0:
image

version 0.3.0:
image

chart install/edit page after installation:
image

AFTER:
version 0.1.0
image

version 0.2.0:
image

version 0.3.0:
image

chart install/edit page after installation:
image

Note: For the linux only charts from Rancher repos we keep the behaviour as before.

Checklist

  • The PR is linked to an issue and the linked issue has a Milestone, or no issue is needed
  • The PR has a Milestone
  • The PR template has been filled out
  • The PR has been self reviewed
  • The PR has a reviewer assigned
  • The PR has automated tests or clear instructions for manual tests and the linked issue has appropriate QA labels, or tests are not needed
  • The PR has reviewed with UX and tested in light and dark mode, or there are no UX changes
  • The PR has been reviewed in terms of Accessibility
  • The PR has considered, and if applicable tested with, the three Global Roles Admin, Standard User and User Base

@momesgin momesgin added this to the v2.15.0 milestone Apr 23, 2026
@momesgin momesgin self-assigned this Apr 23, 2026
@momesgin momesgin requested a review from Copilot April 23, 2026 16:21
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates OS compatibility handling so the default linux restriction is only applied to charts coming from official Rancher repos, preventing third-party charts without catalog.cattle.io/permits-os from being blocked on Windows clusters.

Changes:

  • Adjusts compatibleVersionsFor to avoid defaulting to linux for non-Rancher charts when permits-os is missing.
  • Introduces a shared isRancherRepo(repo, chart) helper and applies it in chart install UX and version selection logic.
  • Adds unit tests for isRancherRepo and the updated compatibleVersionsFor behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File Description
shell/store/catalog.js Updates OS filtering logic and adds isRancherRepo helper.
shell/store/__tests__/catalog.test.ts Adds unit tests for repo detection and OS compatibility filtering.
shell/pages/c/_cluster/apps/charts/install.vue Updates Windows-incompatible warning logic to use isRancherRepo.
shell/mixins/chart.js Updates version disabling/labeling logic to only apply the Linux fallback for Rancher repos.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread shell/pages/c/_cluster/apps/charts/install.vue
Comment thread shell/store/__tests__/catalog.test.ts Outdated
Comment thread shell/store/catalog.js Outdated
momesgin and others added 6 commits April 23, 2026 10:22
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Comment thread shell/components/SelectIconGrid.vue
Comment thread shell/store/catalog.js Outdated
@momesgin momesgin requested a review from nwmac April 24, 2026 00:42
@momesgin momesgin marked this pull request as ready for review April 24, 2026 00:43
@momesgin momesgin requested a review from richard-cox April 24, 2026 00:44
Copy link
Copy Markdown
Member

@richard-cox richard-cox left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The same process is happening in four places, can the logic be extracted to somewhere common?

Comment thread shell/mixins/chart.js Outdated
@momesgin momesgin requested a review from richard-cox April 30, 2026 20:31
Copy link
Copy Markdown
Member

@richard-cox richard-cox left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In terms of the last review comment

Comment thread shell/store/catalog.js Outdated
Comment thread shell/store/catalog.js
Comment thread shell/store/catalog.js
Comment thread shell/store/catalog.js Outdated
Comment thread shell/mixins/chart.js Outdated
@momesgin momesgin merged commit 4cc0f9f into rancher:master May 21, 2026
104 of 105 checks passed
@momesgin momesgin deleted the 11670-charts-os-restriction branch May 21, 2026 17:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Only apply OS/Arch chart restrictions to rancher repos

4 participants