ROX-13378: Group new resources with deprecated in UI by ivan-degtiarenko · Pull Request #3690 · stackrox/stackrox

ivan-degtiarenko · 2022-11-04T00:22:18Z

Description

Creates banner on Access Control page notifying of resource changes
Creates log entry similar to banner on Central startup
All replacing resources are marked in the UI
All deprecated/to-be-deprecated/to-be-removed resources are marked and show the version of deprecation
Added ClusterCVE resource description as it was missing
Guard “Integrations” by Integration permission

Checklist

Investigated and inspected CI test results
Unit test and regression tests added
Evaluated and added CHANGELOG entry if required
Determined and documented upgrade steps
Documented user facing changes (create PR based on openshift/openshift-docs and merge into rhacs-docs)

If any of these don't apply, please comment below.

Testing Performed

Screen.Recording.2022-11-04.at.01.01.57.mov

rukletsov

Thanks, Ivan, this looks good. We can ship once we get approval from someone's on the UI team and Yann merges his PR chain.

Could you please add a note to https://issues.redhat.com/browse/ROX-12750 that most of the the code added here should also be removed?

central/main.go

rukletsov · 2022-11-04T08:02:25Z

ui/apps/platform/src/Containers/AccessControl/AccessControl.tsx

+                    <>
+                        <p>Next access resources will be replaced:</p>
+
+                        <p>


Maybe a list for readability?

When I try to use a list within this Alert component, it does not show up as a list. Wanted to ask @pedrottimark or @vjwilson if they know what might be the reason for this behaviour.

When I try to use a list within this Alert component, it does not show up as a list. Wanted to ask @pedrottimark or @vjwilson if they know what might be the reason for this behaviour.

There were were pretty strict style resets in pre-Red Hat style sheet, and we can't remove them until all the old style pages have been updated. We'd probably need to add a specific override in this file until then, to make a list show in this component.

https://github.com/stackrox/stackrox/blob/master/ui/apps/platform/src/css/trumps.css

rukletsov · 2022-11-04T08:08:08Z

central/main.go

+		"	Image now also covers ImageComponent\n" +
+		"The resources getting deprecated, but not replaced yet are:\n" +
+		"	Administration will replace AllComments, Config, DebugLogs, NetworkGraphConfig, ProbeUpload, ScannerDefinitions, SensorUpgradeConfig and ServiceIdentity.\n" +
+		"	Compliance will replace ComplianceRuns")


ClusterCVE is missing, also in the UI banner.

Makes sense to add it, I'm just not sure I have the context yet.
Will ClusterCVE be replaced by another resource or just removed?

ClusterCVE -> Cluster

rukletsov · 2022-11-04T08:10:08Z

ui/apps/platform/src/constants/accessControl.ts

+    ['ScannerBundle', 'Administration'],
+    ['ScannerDefinitions', 'Administration'],
+    ['SensorUpgradeConfig', 'Administration'],
+    ['ServiceIdentity', 'Administration'],


Any reason why ClusterCVE is not in this list?

My understanding was that ClusterCVE will be removed and not replaced by anything. @rhybrillou is that the case?

@md2119 @theencee

How is ClusterCVE related to this change?

ClusterCVE -> Cluster

md2119 · 2022-11-04T20:32:08Z

central/activecomponent/updater/updater_impl.go

@@ -25,7 +25,7 @@ var (

 	updaterCtx = sac.WithGlobalAccessScopeChecker(context.Background(),


Probably not for now, but IMO all inits of scope contexts to fulfill internal workflows should be changed to sac.WithGlobalAccess(context.Background()). We know the purpose of each init ctx such as, building index at startup, or removing dependent resources, etc., and that these are used internally only. There is a risk, which historically has realized more than expected, that some feature begins depending on additional sac resources and insufficient context cause is not the obvious.

md2119 · 2022-11-04T20:37:48Z

central/deployment/datastore/datastore_impl.go

@@ -270,7 +270,7 @@ func (ds *datastoreImpl) RemoveDeployment(ctx context.Context, clusterID, id str
 	deleteRelatedCtx := sac.WithGlobalAccessScopeChecker(ctx,


same comment as above

md2119 · 2022-11-04T20:42:17Z

central/main.go

 	log.Infof("Running StackRox Version: %s", pkgVersion.GetMainVersion())
+	// TODO: ROX-12750 update with new list of replaced/deprecated resources
+	log.Warn("The following permission resources have been replaced:\n" +
+		"	Access replaces AuthProvider, Group, Licenses and User\n" +


nit: , and here and below

md2119 · 2022-11-04T20:42:58Z

central/main.go

+		"	Image now also covers ImageComponent\n" +
+		"The resources getting deprecated, but not replaced yet are:\n" +
+		"	Administration will replace AllComments, Config, DebugLogs, NetworkGraphConfig, ProbeUpload, ScannerDefinitions, SensorUpgradeConfig and ServiceIdentity.\n" +
+		"	Compliance will replace ComplianceRuns")


ClusterCVE -> Cluster

md2119 · 2022-11-04T20:49:01Z

ui/apps/platform/src/constants/accessControl.ts

+    ['ScannerBundle', 'Administration'],
+    ['ScannerDefinitions', 'Administration'],
+    ['SensorUpgradeConfig', 'Administration'],
+    ['ServiceIdentity', 'Administration'],


ClusterCVE -> Cluster

gitguardian · 2022-11-05T23:38:59Z

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
Once a secret has been leaked into a git repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Our GitHub checks need improvements? Share your feedbacks!}}

pedrottimark · 2022-11-07T17:57:36Z

ui/apps/platform/src/Containers/Integrations/IntegrationsPage.tsx

+                    <Route component={IntegrationsNotFoundPage} />
+                </Switch>
+            ) : (
+                <IntegrationsNoPermission />


What’s done is done. Was this a broken page which requires this change just before release?

This is related to this discussion:
https://srox.slack.com/archives/C02L9F6KR25/p1667488912824189

ivan-degtiarenko · 2022-11-07T20:23:59Z

/retest

md2119

Nice work, @ivan-degtiarenko!

md2119 · 2022-11-07T22:15:28Z

central/main.go

+		"The following permission resources will be replaced in the upcoming versions:\n" +
+		"	Administration will replace AllComments, Config, DebugLogs, NetworkGraphConfig, ProbeUpload, ScannerBundle, ScannerDefinitions, SensorUpgradeConfig, and ServiceIdentity\n" +
+		"	Compliance will replace ComplianceRuns\n" +
+		"	Cluster will replace ClusterCVE.")


minor nit: Cluster will cover ClusterCVE.

dhaus67

LGTM modulo one comment regarding the introduction of the ClusterCVE resource within the UI list + you have failing UI E2E tests which you should probably fix before merging.

dhaus67 · 2022-11-08T09:00:00Z

ui/apps/platform/src/Containers/AccessControl/PermissionSets/ResourceDescription.tsx

        'Read: N/A Write: Delete comments from other users. All users can edit and delete their own comments by default. To add and remove comments or tags, you need a role with write access for the resource you are modifying.',
    CVE: 'Internal use only',
    Cluster: 'Read: View secured clusters. Write: Add, modify, or delete secured clusters.',
+    ClusterCVE: 'Internal use only',


Do we have to add it within the UI as a new resource? I know we have other resources that are being leaked to the UI that are for internal use only, but why add another one?

ClusterCVE is returned as a resource from the backend, this change just makes sure it's description is not empty

I see. It's unfortunate that we return it then in the first place, I suppose such is life then for the internal resources.

ghost · 2022-11-08T12:42:05Z

Images are ready for the commit at 1acbc0c.

To use with deploy scripts, first export MAIN_IMAGE_TAG=3.72.x-550-g1acbc0c253.

ivan-degtiarenko · 2022-11-08T19:22:58Z

As discussed with @pedrottimark, errors within ci/prow/gke-ui-e2e-tests are known flakes and are being investigated.

ivan-degtiarenko · 2022-11-08T19:23:15Z

/retest

openshift-ci · 2022-11-08T20:25:38Z

@ivan-degtiarenko: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/gke-ui-e2e-tests	`1acbc0c`	link	false	`/test gke-ui-e2e-tests`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

pedrottimark · 2022-11-08T23:04:33Z

@ivan-degtiarenko You can rebase to get #3748 which fixes gke-ui-e2e-tests failure.

7ffc6be ROX-13368: Skip failing nongroovy tests on PG (#3721) bbdd7a0 Bump github.com/gofrs/uuid from 4.3.0+incompatible to 4.3.1+incompatible (#3642) 1f253f2 Bump github.com/google/certificate-transparency-go from 1.1.3 to 1.1.4 (#3543) d434c8d [ROX-13030] : Add delete collection API endpoint and service implementation (#3648) f062c21 Dashrews/ROX-13253 wait for central-db to come back after bounce and allow FATAL connection lost error (#3537) edc1174 CI: Fill the gaps for https://testgrid.k8s.io/ (#3715) 86d7c54 ROX-13231: use passed context when non-postgres (#3540) 9093195 Add less specific type for BE collection response string (#3728) 5abb652 Only enable ROX_OBJECT_COLLECTIONS feature flag during gke-postgres-ui-e2e job (#3727) 4f64cd1 Add centralDBOnly mode in render (#3707) d67bbe5 Dashrews/ROX-13082 UUID searcher and common updates to set allow use of postgres UUID PR 1 of 4 (#3679) 6f829d5 ROX-13259: graphInit called during init time (#3705) f3bc50d ROX-13380: Conditional rendering edges for deployments and namespaces (#3641) 3764476 ROX-12319: implement smoke test step with groovy test filter (#3220) f202fd4 ROX-11826: Disable kernel support package uploads for managed central (#3661) 61f03dc ROX-11101: Remove deprecated resources from central (#3115) e6aa6d7 ROX-11101: Restore Role permission in UI (#3428) 3203e04 ROX-11101: Remove deprecated resources (#3036) a35f41e Bump golang.org/x/sys from 0.1.0 to 0.2.0 (#3733) 4120524 Bump snakeyaml from 1.29 to 1.33 in /qa-tests-backend (#3732) e1785c0 Bump github.com/coreos/go-systemd/v22 from 22.4.0 to 22.5.0 (#3724) 870df4a Bump google.golang.org/api from 0.101.0 to 0.102.0 (#3723) 721454c Generalize User-Agent setup (#3672) 6a11bf0 Bumps collector version to 3.11.x-145-gc345f72f5e (#3736) ec5d343 [ROX-12923] Walk retries - remainder work (#3729) 40f3d43 ROX-13440: Replace ambiguous central with sensor in networkGraph integration test (#3730) 281ed22 Bump groovy-xml from 2.5.18 to 2.5.19 in /qa-tests-backend (#3741) 49d1651 Bump github.com/prometheus/client_golang from 1.13.1 to 1.14.0 (#3742) b5544aa Bump cloud.google.com/go/storage from 1.27.0 to 1.28.0 (#3743) 9c61e53 ensure CVSS is present for istio vulns (#3706) ae29d52 ROX-13452: don't always clobber scoped ctx when non-postgres (#3748) 517bf05 ROX-13261: DryRunUpdate on collection datastore (#3687) baf7654 ROX-13378: Group new resources with deprecated in UI (#3690) 569922f ROX-13421: Enable roxctl netpol generate and add tech-preview messages (#3740) 2465fc5 Dashrews/ROX-13082 UUID generator templates PR 2 of 4 (#3681) c093c68 Bump slack-api-client from 1.20.2 to 1.27.0 in /qa-tests-backend (#3752) 2c860bb Bump ubi8-micro from 8.6 to 8.7 in /operator (#3751) 80eb04c Make deploy.sh and deploy-local.sh pass shellcheck (#3582) 2182b43 Dashrews/ROX-13082 UUID test updates PR 3 of 4 (#3694) 6dc6ca5 [ROX-13403] : Fix node -> topVuln sub resolver bug when node cves is empty (#3689) 1b21361 Move integration tests for page title from general to specific containers (#3675) e1a9f31 Bump google.golang.org/api from 0.102.0 to 0.103.0 (#3773) a05ea31 Bump golang.org/x/crypto from 0.1.0 to 0.2.0 (#3772) 65ddf4f ROX-12824: Add roxctl commands to generate Central DB bundle (#3602) c3f1e2f Remove obsolete authProviders request for Integrations page (#3759) 7ccd54d Dashrews/ROX-13082 UUID protos generated PR 4 of 4 (#3698) 9ab5c8f cleanup image digest utilities (#3764) 187ed44 ROX-11931: Convert junit failure artifacts to Slack attachments (#3438) b5d8790 ROX-13432: leaning up unused code copied/pasted from topology demo (#3750) ab05bfc Refactor collection form page for better composition (#3744) c5562f7 Remove babel devDependencies in ui-components (#3761) 2b90b3a Extract collection form from drawer wrapper layout (#3745) a779fc9 [ROX-12625 + ROX-13032] : Add GetCollectionCount and UpdateCollection endpoints and services (#3749) e77f0da Upgrade cypress 11.0.0 devDependencies in ui (#3760) a3fba94 ROX-13068: Use real data for deployment details (#3688) 4c7d90e ROX-12617: Collection to search query converter (#3683) 3e98aec ROX-13067: fill out port configurations section of deployment details (#3714) a48de36 ROX-12835: Add support for NodeScanV2 to Sensor (#3533) 30c5dc7 ROX-13466: Fix deletion of groups with empty properties (#3756) 5cb2470 Add autocomplete for name selector dropdowns (#3676) b9a75ad ROX-13464 adding flows dropdown in NG (#3763) 3217a67 [ROX-13500] Perform type check for V1 CronJob (#3787) af3790d Remove bulk delete from collections table (#3776) dda123b Add more info in migration log (#3788) 179f0c9 ROX-13502: Remove the circular dependency between cluster datastore init and cscc notifier init (#3790) 029d584 Update SCANNER_VERSION (#3774) cbca57c Bump github.com/ckaznocha/protoc-gen-lint from 0.2.4 to 0.3.0 (#3783) 3613b56 Bump golang.org/x/tools from 0.2.0 to 0.3.0 (#3782) 5fc0a6a Bump github.com/google/go-containerregistry from 0.12.0 to 0.12.1 (#3781) 1d1c687 Bump controller-gen version to 0.10.0 (#3754) c3a5290 Untie documentation link from the product version (#3799) ed822aa use correct package for migration (#3784) 397a0b4 Validate that label keys are valid k8s labels and ensure correct key splitting (#3777) edd1050 Rename variable ScannerGRPCEndpoint to ScannerSlimGRPCEndpoint (#3657) 6662c9f ROX-13378: Access Control page permissions (#3720) b0e73c5 fix Operator reconciliation for external Central DB (#3796) b83bc1f ROX-13505: Fix error log scanning the postgres stat collection (#3795) ca660cb Prevent the collection being edited from displaying in its own embedded list (#3778) 3f7b3fc [ROX-13441][POSTGRES] Propagate context correctly in retries (#3793) e0cbc6f ROX-12839: Update changelog to announce removal of in-product docs (#3805) 696e8bc [ROX-12358] Follow up on vulnerability request proto change (#2851) c4b46d8 Change getCollectionCount endpoint and updateCollection request type 5f2efbc remove make proto-fmt (#3804) 0c75540 Remove os.Std* from roxctl/central (#3758) 25a90de Add ability to view embedded collections in a pop up modal (#3747) 5c1bf81 ROX-13240: fix scanner-slim updates when WebSockets are used (#3704) 1d98577 Add more context to jira notifier logging (#3812) da2fd28 ROX-13031: DryRun Collection API (#3766) 1c418d5 Test data migration code in postgres tests (#3803) ed95b37 Update UI Collection requests for BE compatibiltiy (#3762) 09cc188 ROX-11931: Fix junit-parse install in CI (#3811) d2b01e3 ROX-12814: Disable PolicyFieldsTest on openshift. (#3797) d10ce27 ROX-13345: disable 'missing required registry' aspect on openshift (#3798) 3d22396 Update collector to 3.12 (#3809) 1eb33fb ROX-13347: Modify scope queries to included quoted cluster and nameace names, to allow exact matches instead of erroneous and unintended prefix matches. (#3767) 3811a69 ROX-12621: list collection selectors api (#3806) f6d3f9d Add migration for groups with invalid values (#3789) cc21125 Bugfixes for collection autocomplete (#3816) 7623dec ROX-9350 Use fine-grained host paths for compliance mounts (#2479) b4bf5c2 Fix collector volumeMounts (#3826) 0e9be05 ROX-12953: figure out last 4 versions of sensor automatically (#3611) 459c7ae ROX-12814: Add proper todo for reenabling the test (#3817) 9ee40ff ROX-13523: add isEnabled enum to central db spec (#3815) 535bc72 Replace requestConfig with routeMatcherMap in helper functions for integration tests (#3686) 2b75b61 `gosec` G104: Add `ShouldErr(err)` that returns `err` (#3830) fb1b82f WIP: Introduce nodescan call 35f8a8f WIP: Prepare converter 716144b Moved and renamed fake nodescan tests 4748de7 Introduce real node scanner with conversion functions 5e6d9a8 wip: real scanner 0169868 wip: log results 1438d2c wip: Debug Analyze call b09894c wip: Debug Analyze call 3ceed72 wip: Update and improve debug logs d1669fd Remove copied lib, bump scanner version, add debug 14a3f73 Merge branch 'master' into mm/ROX-12967-real-nodescan fbd0450 Fix style issues 17ccb31 Debug: let both scans finish to see what they return

ivan-degtiarenko requested review from pedrottimark, rhybrillou, rukletsov and vjwilson November 4, 2022 00:22

github-actions bot added area/central area/ui labels Nov 4, 2022

rukletsov requested a review from dhaus67 November 4, 2022 07:57

rukletsov reviewed Nov 4, 2022

View reviewed changes

ivan-degtiarenko requested a review from rukletsov November 4, 2022 14:25

rhybrillou force-pushed the yann/ROX-11101-central_remove_old_resources branch from 5ca8289 to 7d53e9c Compare November 4, 2022 16:53

rhybrillou requested a review from a team as a code owner November 4, 2022 16:53

md2119 reviewed Nov 4, 2022

View reviewed changes

github-actions bot added area/postgres ci-postgres-tests labels Nov 5, 2022

ivan-degtiarenko force-pushed the ivan/rox-13378-group-resources-ui branch from 683aaaa to 0bfc630 Compare November 5, 2022 23:38

ivan-degtiarenko requested review from a team as code owners November 5, 2022 23:38

github-actions bot added area/admission-controller area/auth area/helm area/operator area/roxctl area/sensor ci-all-qa-tests Tells CI to run all API tests (not just BAT). labels Nov 5, 2022

ivan-degtiarenko force-pushed the ivan/rox-13378-group-resources-ui branch from 0bfc630 to 97b52e5 Compare November 5, 2022 23:49

ivan-degtiarenko removed ci-all-qa-tests Tells CI to run all API tests (not just BAT). area/roxctl area/helm area/operator labels Nov 6, 2022

pedrottimark reviewed Nov 7, 2022

View reviewed changes

ivan-degtiarenko requested review from pedrottimark and rhybrillou November 7, 2022 21:31

md2119 approved these changes Nov 7, 2022

View reviewed changes

rhybrillou force-pushed the yann/ROX-11101-central_remove_old_resources branch from d11a866 to 55102b7 Compare November 8, 2022 08:30

dhaus67 approved these changes Nov 8, 2022

View reviewed changes

An error occurred while trying to automatically change base from yann/ROX-11101-central_remove_old_resources to master November 8, 2022 09:46

ivan-degtiarenko added 4 commits November 8, 2022 13:18

Mark deprecated and replaced access resources; banner; log entry

6b6d26b

html list -> patternfly list

85744f8

Address feedback

2052116

change phrasing for Cluster<->ClusterCVE

0f9af8e

ivan-degtiarenko force-pushed the ivan/rox-13378-group-resources-ui branch from 78d857d to 0f9af8e Compare November 8, 2022 12:18

github-actions bot added the area/postgres label Nov 8, 2022

ivan-degtiarenko changed the base branch from yann/ROX-11101-central_remove_old_resources to master November 8, 2022 12:20

Add comment regarding removal

2ebbe71

ivan-degtiarenko removed area/central area/postgres labels Nov 8, 2022

rhybrillou approved these changes Nov 8, 2022

View reviewed changes

Fix ui tests

1acbc0c

github-actions bot added the area/central label Nov 8, 2022

pedrottimark approved these changes Nov 8, 2022

View reviewed changes

ivan-degtiarenko merged commit baf7654 into master Nov 9, 2022

rukletsov deleted the ivan/rox-13378-group-resources-ui branch September 16, 2025 16:41

		@@ -25,7 +25,7 @@ var (

		updaterCtx = sac.WithGlobalAccessScopeChecker(context.Background(),

		@@ -270,7 +270,7 @@ func (ds *datastoreImpl) RemoveDeployment(ctx context.Context, clusterID, id str
		deleteRelatedCtx := sac.WithGlobalAccessScopeChecker(ctx,

Conversation

ivan-degtiarenko commented Nov 4, 2022

Description

Checklist

Testing Performed

Uh oh!

rukletsov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ivan-degtiarenko Nov 4, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gitguardian bot commented Nov 5, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

️✅ There are no secrets present in this pull request anymore.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ivan-degtiarenko commented Nov 7, 2022

Uh oh!

md2119 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dhaus67 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ghost commented Nov 8, 2022 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ivan-degtiarenko commented Nov 8, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ivan-degtiarenko commented Nov 8, 2022

Uh oh!

openshift-ci bot commented Nov 8, 2022

Uh oh!

pedrottimark commented Nov 8, 2022

Uh oh!

Reviewers

ivan-degtiarenko Nov 4, 2022 •

edited

Loading

gitguardian bot commented Nov 5, 2022 •

edited

Loading

ghost commented Nov 8, 2022 •

edited by ghost

Loading

ivan-degtiarenko commented Nov 8, 2022 •

edited

Loading