Andrey Kolkov 3a8a06b44f fix(dashboard): let dashboard users read backup CRD schemas ...

The dashboard backup build/edit forms build each form from the CRD's
OpenAPI schema, which useCRDSchema fetches directly from
apiextensions.k8s.io with the logged-in user's token — a cluster-scoped
get on the CRD by name. No role a tenant user carries granted
customresourcedefinitions, so every tenant user hit a 403 on the schema
lookup and the form never rendered, while kubectl kept working through
the existing backup CR grants.

The tenant personas are bound only by RoleBindings, which cannot
authorize a cluster-scoped request, so the grant belongs on
cozystack-dashboard-readonly: it is bound to system:authenticated by a
ClusterRoleBinding and already carries the dashboard's other
cluster-scoped reads. Add a get on the five backups.cozystack.io CRDs,
scoped by resourceNames to those schemas only.

Fixes: cozystack/cozystack#4053

Assisted-By: LLM
Signed-off-by: Andrey Kolkov <androndo@gmail.com>

2026-09-17 15:48:14 +04:00

..

apps

fix(bucket): stop the ACME cleanup hook from talking to localhost, and gate the class (#4289)

2026-09-17 14:21:15 +03:00

core

fix(seaweedfs): raise the number of buckets a volume server can serve

2026-09-17 00:54:48 +03:00

extra

fix(seaweedfs): raise the number of buckets a volume server can serve

2026-09-17 00:54:48 +03:00

library

fix(cozy-lib): guard fractional-negative minReplicaCount and cover the pause-merge collision

2026-09-10 15:31:24 +03:00

system

fix(dashboard): let dashboard users read backup CRD schemas

2026-09-17 15:48:14 +04:00

tests/cozy-lib-tests

fix(cozy-lib): guard fractional-negative minReplicaCount and cover the pause-merge collision

2026-09-10 15:31:24 +03:00