Skip to content

Conversation

@Leo6Leo
Copy link
Contributor

@Leo6Leo Leo6Leo commented Oct 15, 2025

Description

As a cluster administrator want to impersonate a user with multiple group memberships simultaneously, so that I can accurately reproduce their effective permissions and troubleshoot RBAC issues.

The feature flag bridge/impersonate-enabled in localStorage will keep the feature hidden/display from users until all frontend and backend components are complete and merged.

The flag is disabled by default.

// Enable the feature
localStorage.setItem('bridge/impersonate-enabled', 'true'); location.reload();
// Disable the feature
localStorage.setItem('bridge/impersonate-enabled', 'false'); location.reload();

Leo6Leo added 10 commits October 6, 2025 14:44
…tion

Support multiple Impersonate-Group subprotocols on WebSocket connections.
Maintains backward compatibility for single-group impersonation.
…nation

Handle X-Console-Impersonate-Groups header by splitting comma-separated
groups into multiple Impersonate-Group headers for Kubernetes API.
Update GraphQL context to support array-valued headers for multi-group
impersonation. Change headers type from map[string]string to map[string]interface{}
to support both single string values and []string arrays.
Update fetch utilities to handle multi-group impersonation:
- Support array-valued Impersonate-Group headers
- Convert array to X-Console-Impersonate-Groups for fetch() API compatibility
- Add UserWithGroups kind support in header generation
…ation

Add multi-group support to Redux actions:
- Update startImpersonate to accept groups parameter
- Encode multiple groups as WebSocket subprotocols in UserWithGroups mode
- Pass groups to beginImpersonate action
- Expose store and UIActions for testing (temporary)
Add modal component for multi-group user impersonation:
- TypeScript React component with group selection
- Multi-select group input with search/filter
- Chip display for selected groups
- Form validation for username
- Internationalization support
Integrate multi-group impersonation into the UI:
- Update impersonation banner to display multiple groups
- Add modal trigger in masthead toolbar
- Update user component to show impersonated user
- Add feature flag checks in app component
- Add masthead menu items for start/stop impersonation
- Add enabled parameter to usePackageManifestCheck hook
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Oct 15, 2025
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Oct 15, 2025

@Leo6Leo: This pull request references CONSOLE-4734 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

In response to this:

Description

As a cluster administrator want to impersonate a user with multiple group memberships simultaneously, so that I can accurately reproduce their effective permissions and troubleshoot RBAC issues.

The feature flag bridge/impersonate-enabled in localStorage will keep the feature hidden/display from users until all frontend and backend components are complete and merged.

The flag is disabled by default.

// Enable the feature
localStorage.setItem('bridge/impersonate-enabled', 'true'); location.reload();
// Disable the feature
localStorage.setItem('bridge/impersonate-enabled', 'false'); location.reload();

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot requested review from jhadvig and sg00dwin October 15, 2025 19:12
@openshift-ci openshift-ci bot added the component/backend Related to backend label Oct 15, 2025
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 15, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Leo6Leo
Once this PR has been reviewed and has the lgtm label, please assign jhadvig for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the component/core Related to console core functionality label Oct 15, 2025
window.store = store;
}

// Temporary: Expose store for testing multi-group impersonation
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This need to get removed whenever the PR is ready to get merged.

@openshift-ci openshift-ci bot added component/sdk Related to console-plugin-sdk component/shared Related to console-shared kind/i18n Indicates issue or PR relates to internationalization or has content that needs to be translated labels Oct 15, 2025
@Leo6Leo
Copy link
Contributor Author

Leo6Leo commented Oct 22, 2025

/cc @logonoff

@openshift-ci openshift-ci bot requested a review from logonoff October 22, 2025 16:30
Copy link
Member

@logonoff logonoff left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

first pass

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 22, 2025
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 23, 2025
@Leo6Leo Leo6Leo requested a review from logonoff October 23, 2025 18:05
@logonoff
Copy link
Member

Frontend test is failing

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 23, 2025

@Leo6Leo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/okd-scos-e2e-aws-ovn 4cbb020 link false /test okd-scos-e2e-aws-ovn
ci/prow/frontend 4cbb020 link true /test frontend

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

component/backend Related to backend component/core Related to console core functionality component/sdk Related to console-plugin-sdk component/shared Related to console-shared jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. kind/i18n Indicates issue or PR relates to internationalization or has content that needs to be translated

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants