Backport of [ui] Read-based checks for viewing templates and write-based checks for saving them into release/1.8.x #23469
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport
This PR is auto-generated from #23458 to be assessed for backporting due to the inclusion of the label backport/1.8.x.
The below text is copied from the body of the original PR.
This adds nuance to the ACL policy checks for a user to be able to see Job Templates (which are specifically-named Nomad Variables behind the scenes).
The way it works today has some specific checks in place:
submit-job
ACL capability, or a general"write"
policy.*
.I think the original intent here was to do up-front checks for full CRUD access, but this PR moves that access check a little downstream. Here, you'll see that the check to see the "Choose from template" button requires specifically
read variable
access (and I could be convinced to make itlist variables
, but that would make the subsequent page pretty useless), and thewrite variable
check is moved downstream to the "save as template" button, and to manually edit a given job template via the Management page.Here is a sample ACL policy to test with:
^--- the
submit-job
capability is in place, so the "Run Job" button will be present. Also, thenomad/job-templates/*
rule has bothread
andwrite
, which will show both a "Choose from template" and a "Save as template" button. Remove either read or write to see how buttons disappear accordingly.User has read and write, but not delete, variable capability:
User has
read variables
fornomad/job-templates/*
:User has
write variables
fornomad/job-templates/*
:Resolves #23438
Overview of commits