Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ui: Remove unrequired node read from task log streaming page. #24973

Merged
merged 3 commits into from
Jan 30, 2025
Merged

Conversation

jrasell
Copy link
Member

@jrasell jrasell commented Jan 29, 2025

Description

The node read on the task logs page is not required and therefore should be callable by users which do not have node:read in their ACL token capabilities. The job allocation logs work without this currently, so this not only fixes the bug, but also creates better consistency across pages.

Testing & Reproduction steps

Linked GitHub issue has good reproduction steps.

Links

Jira: https://hashicorp.atlassian.net/browse/NET-11262
Closes: #23786

Contributor Checklist

  • Changelog Entry If this PR changes user-facing behavior, please generate and add a
    changelog entry using the make cl command.
  • Testing Please add tests to cover any new functionality or to demonstrate bug fixes and
    ensure regressions will be caught.
  • Documentation If the change impacts user-facing functionality such as the CLI, API, UI,
    and job configuration, please update the Nomad website documentation to reflect this. Refer to
    the website README for docs guidelines. Please also consider whether the
    change requires notes within the upgrade guide.

Reviewer Checklist

  • Backport Labels Please add the correct backport labels as described by the internal
    backporting document.
  • Commit Type Ensure the correct merge method is selected which should be "squash and merge"
    in the majority of situations. The main exceptions are long-lived feature branches or merges where
    history should be preserved.
  • Enterprise PRs If this is an enterprise only PR, please add any required changelog entry
    within the public repository.

@jrasell jrasell self-assigned this Jan 29, 2025
@jrasell jrasell added backport/ent/1.7.x+ent Changes are backported to 1.7.x+ent backport/ent/1.8.x+ent Changes are backported to 1.8.x+ent backport/1.9.x backport to 1.9.x release line labels Jan 29, 2025
@jrasell jrasell marked this pull request as ready for review January 29, 2025 11:34
@jrasell jrasell requested review from a team as code owners January 29, 2025 11:34
@philrenaud
Copy link
Contributor

Made a commit @ 7b9a616 and wanted to explain what's happening:

  1. The change to remove the node lookup from the route's model() hook is good, and will prevent a permissions error page from showing up in lieu of the logs page
  2. However, the logs route loads a component, <TaskLog>, which itself will attempt to fetch logs from v1/client/fs/logs/$allocID at the present host, and if that fails, will try to instead read them from $nodeAddress/v1/client/fs/logs/$allocID. In order to get $nodeAddress for this second case, it needs to make a client lookup, requiring node read permissions.

The new commit makes that node lookup conditional upon policiesIncludeNodeRead() permissions being present for the user in question. In the absence of this, no request for the alloc's node info will be made.

This is all to say: slightly fewer 403s in your server logs with this. The original commit handles all the important stuff!

@philrenaud philrenaud requested a review from tgross January 29, 2025 16:56
Copy link
Member

@tgross tgross left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@jrasell jrasell merged commit bfd5f38 into main Jan 30, 2025
21 of 22 checks passed
@jrasell jrasell deleted the b-NET-11262 branch January 30, 2025 07:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport/ent/1.7.x+ent Changes are backported to 1.7.x+ent backport/ent/1.8.x+ent Changes are backported to 1.8.x+ent backport/1.9.x backport to 1.9.x release line
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Permission Check on Log Access via UI
3 participants