@rancher/shell 0.3.26 → 0.3.28

package/assets/translations/en-us.yaml

@@ -851,9 +851,6 @@ catalog:
       keywords: Keywords
     errors:
       clusterToolExists: This chart has a fixed namespace and name. A matching <a href="{url}">application</a> has been found and any changes will be made to it.
-    banner:
-      legacy: 'PSP Removal: Before upgrading a cluster to Kubernetes 1.25+, please ensure you review your Helm applications for Pod Security Policies and update them accordingly'
-    enablePSP: Enable Pod Security Policies
     global: Global
   charts:
     all: All
@@ -1673,10 +1670,8 @@ cluster:
     os: 'You are attempting to add a {newOS} worker node to a cluster with one or more {existingOS} worker nodes: some installed apps may need to be upgraded or removed.'
     rke2-k3-reprovisioning: 'Making changes to cluster configuration may result in nodes reprovisioning. For more information see the <a target="blank" href="{docsBase}/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/" target="_blank" rel="noopener nofollow">documentation</a>.'
     desiredNodeGroupWarning: There are 0 nodes available to run the cluster agent. The cluster will not become active until at least one node is available.
-    invalidPsps: You have one or more PodSecurityPolicy resource(s) in this cluster. Pod Security Policies are not available in Kubernetes v1.25 and will be automatically removed.
     haveArgInfo: Configuration information is not available for the selected Kubernetes version.  The options available on this screen will be limited; you may want to use the YAML editor.
-    deprecatedPsp: Pod Security Policies are deprecated as of Kubernetes v1.21, and have been removed in Kubernetes v1.25.
-    removedPsp: Pod Security Policies have been removed in Kubernetes v1.25. Use Pod Security Admission instead.
+    cloudProviderAddConfig: 'On Kubernetes 1.27 or greater, the Amazon Cloud Provider requires additional configuration. See <a href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-cloud-providers/amazon" target="_blank" rel="noopener noreferrer nofollow">the documentation</a> for more information.'
     machinePoolError: |-
       {count, plural,
         =1 { {pool_name}: The provided value for {fields} was not found in the list of expected values. This can happen with clusters provisioned outside of Rancher or when options for the provider have changed. }
@@ -1842,9 +1837,6 @@ cluster:
       cisOverride: Changing this setting may affect cluster security as it overrides default CIS settings
       cisUnsupported: The selected Kubernetes Version no longer supports CIS Profile "{cisProfile}". Please select a supported profile. We recommend reviewing the <a href="https://docs.rke2.io/security/hardening_guide" target="_blank" rel="noopener noreferrer nofollow">documentation</a> to evaluate the impact of changing the CIS Profile.
     modal:
-      pspChange:
-        title: Pod Security Policy deprecation
-        body: <p>Kubernetes has removed support for Pod Security Policies (PSPs) starting with version 1.25. If your cluster has PodSecurityPolicy admission controller enabled via "kube-apiserver-arg.enable-admission-plugins" in Cluster YAML, it has to be <i>manually</i> removed before proceeding with the upgrade. Additionally, any PSPs that may be present in the cluster will no longer be available/enforced. Do you want to proceed?</p>
       editYamlMachinePool:
         title: Save Machine Configurations
         body: Machine Configurations define how machines in Pools are deployed.<br><br> They will be saved upfront to ensure valid Cluster YAML can be saved.
@@ -2763,11 +2755,9 @@ landing:
     cpuUsed: CPU Used
     memoryUsed: Memory Used
   seeWhatsNew: Learn more about the improvements and new capabilities in this version.
-  whatsNewLink: "What's new in 2.7"
+  whatsNewLink: "What's new in 2.8"
   learnMore: Learn More
   support: Support
-  psps: PSPs
-  deprecatedPsp: Pod Security Policies are deprecated as of Kubernetes v1.21, and have been removed in Kubernetes v1.25. You have one or more PodSecurityPolicy resource(s) in this cluster.
   community:
     title: Community Support
     docs: Docs
@@ -2833,7 +2823,7 @@ logging:
     dockerRootDirectory: Docker Root Directory
     systemdLogPath: systemd Log Path
     tooltip: 'Some kubernetes distributions log to <code>journald</code>. In order to collect these logs the <code>systemdLogPath</code> needs to be defined. While the <code>/run/log/journal</code> directory is used by default, some Linux distributions do not default to this path.'
-    url: '<a href="https://rancher.com/docs/rancher/v2.6/en/logging/helm-chart-options/" target="_blank" rel="noopener nofollow noreferrer">Learn more</a>'
+    url: '<a href="https://ranchermanager.docs.rancher.com/v2.8/integrations-in-rancher/logging/logging-helm-chart-options" target="_blank" rel="noopener nofollow noreferrer">Learn more</a>'
     default: /run/log/journal
   elasticsearch:
     host: Host
@@ -4341,10 +4331,6 @@ project:
   vmDefaultResourceLimit: VM Default Resource Limit
   resourceQuotas: Resource Quotas
   haveOneOwner: There must be at least one member with the Owner role.
-  psp:
-    default: Cluster Default
-    label: Pod Security Policy
-    current: "{value} (Current)"
 
 
 projectMembers:
@@ -4613,6 +4599,7 @@ rbac:
       restricted-admin:
         label: Restricted Administrator
         description: Restricted Admins have full control over all resources in all downstream clusters but no access to the local cluster.
+        deprecation: 'Warning: The Restricted Administrator role has been deprecated as of Rancher 2.8.0 and will be removed in a future release - Check out the <a href="{releaseNotesUrl}" target="_blank" rel="noopener noreferrer nofollow">Release Notes</a>'
       user:
         label: Standard User
         description: Standard Users can create new clusters and manage clusters and projects they have been granted access to.
@@ -4649,9 +4636,6 @@ rbac:
       nodetemplates-manage:
         label: Manage Node Templates
         description: Allows the user to define, edit, and remove Node Templates.
-      podsecuritypolicytemplates-manage:
-        label: Manage Pod Security Policies (PSPs)
-        description: Allows the user to define, edit, and remove PSPs.
       roles-manage:
         label: Manage Roles
         description: Allows the user to define, edit, and remove Role definitions.
@@ -5753,7 +5737,10 @@ validation:
         required: 'Port Rule [{position}] - Target Port is required'
   setting:
     serverUrl:
-      https: server-url must be https.
+      https: Server URL must be https.
+      localhost: If the Server URL is internal to the Rancher server (e.g. localhost) the downstream clusters may not be able to communicate with Rancher.
+      trailingForwardSlash: Server URL should not have a trailing forward slash.
+      url: Server URL must be an URL.
   stringLength:
     between: '"{key}" should be between {min} and {max} {max, plural, =1 {character} other {characters}}'
     exactly: '"{key}" should be {count, plural, =1 {# character} other {# characters}}'
@@ -7079,7 +7066,6 @@ advancedSettings:
     'auth-user-session-ttl-minutes': 'Custom TTL (in minutes) on a user auth session.'
     'auth-token-max-ttl-minutes': 'Max TTL (in minutes) for all authentication tokens. When set to 0, the token never expires.'
     'kubeconfig-generate-token': 'Automatically generate tokens for users when a kubeconfig is requested.'
-    'kubeconfig-token-ttl-minutes': 'TTL used for tokens generated via the CLI. Deprecated: This setting will be removed, and kubeconfig-default-token-ttl-minutes will be used for all kubeconfig tokens.'
     'kubeconfig-default-token-ttl-minutes': 'TTL (in minutes) applied on all kubeconfig tokens. When set to 0, the token never expires.'
     'rke-metadata-config': 'Configure RKE metadata refresh parameters.'
     'ui-banners': 'Classification banner is used to display a custom fixed banner in the header, footer, or both.'
@@ -7397,7 +7383,6 @@ legacy:
   globalDnsProviders: Global DNS Providers
   notifiers: Notifiers
   monitoring: Monitoring
-  psps: Pod Security Policy Templates
   secrets: Secrets
 
   project:

package/assets/translations/zh-hans.yaml

@@ -845,9 +845,6 @@ catalog:
       keywords: 关键词
     errors:
       clusterToolExists: 此 Chart 含有固定的命名空间和名称。找到一个匹配的 <a href="{url}">应用</a>，任何修改都将应用于此应用。
-    banner:
-      legacy: 'PSP 删除：在将集群升级到 Kubernetes 1.25+ 之前，请确保你针对 PSP 检查了 Helm 应用程序并相应进行更新'
-    enablePSP: 启用 Pod 安全策略
     global: 全局
   charts:
     all: 全部
@@ -1673,10 +1670,7 @@ cluster:
     os: '你正在将 {newOS} worker 节点添加到具有一个或多个 {existingOS} worker 节点的集群。你可能需要升级或删除某些已安装的应用。'
     rke2-k3-reprovisioning: '更改集群配置可能导致节点重新配置。详情请参见 <a target="blank" href="{docsBase}/cluster-provisioning/rke-clusters/behavior-differences-between-rke1-and-rke2/" target="_blank" rel="noopener nofollow">文档</a>。'
     desiredNodeGroupWarning: 没有可用于运行 Cluster Agent 的节点。要让集群变为 Active 状态，至少需要有 1 个可用的节点。
-    invalidPsps: 你在此集群中有一个或多个 PSP 资源。Pod 安全策略在 Kubernetes v1.25 中不可用并将自动删除。
     haveArgInfo: 所选 Kubernetes 版本的配置信息不可用。此屏幕中可用的选项将受到限制，你可能需要使用 YAML 编辑器。
-    deprecatedPsp: Pod 安全策略自 Kubernetes v1.21 起已弃用，并已在 Kubernetes v1.25 中删除。
-    removedPsp: Pod 安全策略已在 Kubernetes v1.25 中删除，请改用 Pod Security Admission。
   rkeTemplateUpgrade: 模板修订版 {name} 可用于升级
 
   availabilityWarnings:
@@ -1835,10 +1829,6 @@ cluster:
       psaChange: PSACT 现在自动设置为 Rancher 默认值
       cisOverride: 更改此设置可能会影响集群安全，因为它会覆盖默认的 CIS 设置
       cisUnsupported: 所选 Kubernetes 版本不再支持 CIS 配置文件 “{cisProfile}”，请选择支持的配置文件。建议你查看<a href="https://docs.rke2.io/security/hardening_guide" target="_blank" rel="noopener noreferrer nofollow">文档</a>评估更改 CIS 配置文件的影响。
-    modal:
-      pspChange:
-        title: 弃用 Pod 安全策略
-        body: <p>从 v1.25 版开始，Kubernetes 已经取消了对 Pod 安全策略 (PSP) 的支持。如果你的集群通过集群 YAML 中的 “kube-apiserver-arg.enable-admission-plugins” 启用了 PodSecurityPolicy 准入控制器，你必须在继续升级之前<i>手动</i>删除它。此外，集群中存在的任何 PSP 将不再可用或强制执行。是否继续操作？</p>
     snapshots:
       suffix: 每个节点的快照
     systemService:
@@ -2735,11 +2725,9 @@ landing:
     cpuUsed: 已用 CPU
     memoryUsed: 已用内存
   seeWhatsNew: 点击右侧链接，了解此版本的新功能和优化。
-  whatsNewLink: "2.7 的新功能"
+  whatsNewLink: "2.8 的新功能"
   learnMore: 了解更多
   support: 支持
-  psps: PSP
-  deprecatedPsp: Pod 安全策略自 Kubernetes v1.21 起已弃用，并已在 Kubernetes v1.25 中删除。你在此集群中有一个或多个 PSP 资源。
   community:
     title: 社区支持
     docs: Rancher 官方文档
@@ -2805,7 +2793,7 @@ logging:
     dockerRootDirectory: Docker 根目录
     systemdLogPath: systemd 日志路径
     tooltip: '某些 Kubernetes 发行版在 <code>journald</code>中记录日志。你需要定义<code>systemdLogPath</code> 以收集日志。默认路径是<code>/run/log/journal</code>，但某些 Linux 发行版不默认使用该路径。'
-    url: '<a href="https://rancher.com/docs/rancher/v2.6/en/logging/helm-chart-options/" target="_blank" rel="noopener nofollow noreferrer">了解更多</a>'
+    url: '<a href="https://ranchermanager.docs.rancher.com/v2.8/integrations-in-rancher/logging/logging-helm-chart-options" target="_blank" rel="noopener nofollow noreferrer">了解更多</a>'
     default: /run/log/journal
   elasticsearch:
     host: 主机
@@ -4314,10 +4302,6 @@ project:
   vmDefaultResourceLimit: 虚拟机默认资源限制
   resourceQuotas: 资源配额
   haveOneOwner: 至少有一名成员需要具有所有者角色。
-  psp:
-    default: 集群默认
-    label: Pod 安全策略
-    current: "{value} (Current)"
 
 
 projectMembers:
@@ -4622,9 +4606,6 @@ rbac:
       nodetemplates-manage:
         label: 管理节点模板
         description: 允许用户定义、编辑和移除节点模板。
-      podsecuritypolicytemplates-manage:
-        label: 管理 Pod 安全策略（PSP）
-        description: 允许用户定义、编辑和移除 Pod 安全策略。
       roles-manage:
         label: 管理角色
         description: 允许用户定义、编辑和移除角色定义。
@@ -7051,7 +7032,6 @@ advancedSettings:
     'auth-user-session-ttl-minutes': '用户认证会话的自定义 TTL（单位：分钟）。'
     'auth-token-max-ttl-minutes': '所有身份认证 Token 的最大 TTL（单位：分钟）。如果设置为 0，则 Token 永不过期。'
     'kubeconfig-generate-token': '请求 kubeconfig 时自动为用户生成 Token。'
-    'kubeconfig-token-ttl-minutes': '在 CLI 中生成的 Token TTL。已弃用：此设置将被删除，kubeconfig-default-token-ttl-minutes 将用于所有 kubeconfig Token。'
     'kubeconfig-default-token-ttl-minutes': '应用于所有 kubeconfig Token 的 TTL（单位：分钟）。如果设置为 0，则 Token 永不过期。'
     'rke-metadata-config': '配置 RKE 元数据刷新参数。'
     'ui-banners': '分类横幅用于在页眉、页脚或两者中显示自定义的固定横幅。'
@@ -7380,7 +7360,6 @@ legacy:
   globalDnsProviders: 全局 DNS 提供商
   notifiers: Notifiers
   monitoring: 监控
-  psps: Pod 安全策略模板
   secrets: 密文
 
   project:
@@ -7461,9 +7440,6 @@ charts:
     service.ui.type:
       label: Longhorn UI 服务
       description: 定义 Longhorn UI 服务类型
-    enablePSP:
-      label: Pod 安全策略
-      description: 为 Longhorn 工作负载设置 Pod 安全策略
     csi.kubeletRootDir:
       label: Kubelet 根目录
       description: 指定 kubelet root-dir。如留空，则自动检测。

package/chart/gatekeeper.vue

@@ -1,14 +1,11 @@
 <script>
 import UnitInput from '@shell/components/form/UnitInput';
-import ChartPsp from '@shell/components/ChartPsp';
 import { Checkbox } from '@components/Form/Checkbox';
 import { mapGetters } from 'vuex';
 
 export default {
-  components: {
-    UnitInput, ChartPsp, Checkbox
-  },
-  props: {
+  components: { UnitInput, Checkbox },
+  props:      {
     value: {
       type:    Object,
       default: () => {
@@ -60,12 +57,6 @@ export default {
       </div>
     </div>
 
-    <!-- Conditionally display PSP checkbox -->
-    <ChartPsp
-      :value="value"
-      :cluster="currentCluster"
-    />
-
     <template v-if="crdValues">
       <!-- gatekeeper versions <1.0.2 do not have this option -->
       <Checkbox

package/chart/istio.vue

@@ -6,7 +6,6 @@ import YamlEditor from '@shell/components/YamlEditor';
 import { mapGetters } from 'vuex';
 import FileSelector from '@shell/components/form/FileSelector';
 import { Banner } from '@components/Banner';
-import ChartPsp from '@shell/components/ChartPsp';
 
 const defaultOverlayFile = `#apiVersion: install.istio.io/v1alpha1
 #kind: IstioOperator
@@ -54,8 +53,7 @@ export default {
     Checkbox,
     FileSelector,
     YamlEditor,
-    Banner,
-    ChartPsp
+    Banner
   },
 
   props: {
@@ -140,13 +138,6 @@ export default {
 
 <template>
   <div>
-    <!-- Conditionally display PSP checkbox -->
-    <ChartPsp
-      :value="value"
-      :title="t('catalog.chart.global')"
-      :cluster="currentCluster"
-    />
-
     <h3>
       {{ t('istio.titles.components') }}
     </h3>

package/chart/logging/index.vue

@@ -2,13 +2,10 @@
 import { mapGetters } from 'vuex';
 import { LabeledInput } from '@components/Form/LabeledInput';
 import { Checkbox } from '@components/Form/Checkbox';
-import ChartPsp from '@shell/components/ChartPsp';
 
 export default {
-  components: {
-    Checkbox, LabeledInput, ChartPsp
-  },
-  props: {
+  components: { Checkbox, LabeledInput },
+  props:      {
     value: {
       type:    Object,
       default: () => {
@@ -83,11 +80,5 @@ export default {
         />
       </div>
     </div>
-
-    <!-- Conditionally display PSP checkbox -->
-    <ChartPsp
-      :value="value"
-      :cluster="currentCluster"
-    />
   </div>
 </template>

package/chart/monitoring/index.vue

@@ -12,7 +12,6 @@ import { LabeledInput } from '@components/Form/LabeledInput';
 import Loading from '@shell/components/Loading';
 import Prometheus from '@shell/chart/monitoring/prometheus';
 import Tab from '@shell/components/Tabbed/Tab';
-import ChartPsp from '@shell/components/ChartPsp';
 
 import { allHash } from '@shell/utils/promise';
 import { STORAGE_CLASS, PVC, SECRET, WORKLOAD_TYPES } from '@shell/config/types';
@@ -26,8 +25,7 @@ export default {
     LabeledInput,
     Loading,
     Prometheus,
-    Tab,
-    ChartPsp
+    Tab
   },
 
   hasTabs: true,
@@ -265,12 +263,6 @@ export default {
             />
           </div>
         </div>
-
-        <!-- Conditionally display PSP checkbox -->
-        <ChartPsp
-          :value="value"
-          :cluster="currentCluster"
-        />
       </div>
     </Tab>
     <Tab

package/chart/rancher-backup/index.vue

@@ -10,7 +10,6 @@ import { allHash } from '@shell/utils/promise';
 import { STORAGE_CLASS, SECRET, PV } from '@shell/config/types';
 import { mapGetters } from 'vuex';
 import { STORAGE } from '@shell/config/labels-annotations';
-import ChartPsp from '@shell/components/ChartPsp';
 
 export default {
   components: {
@@ -19,8 +18,7 @@ export default {
     S3,
     LabeledInput,
     LabeledSelect,
-    Banner,
-    ChartPsp
+    Banner
   },
 
   hasTabs: true,
@@ -169,12 +167,6 @@ export default {
       label="Chart Options"
       name="chartOptions"
     >
-      <!-- Conditionally display PSP checkbox -->
-      <ChartPsp
-        :value="value"
-        :cluster="currentCluster"
-      />
-
       <Banner
         color="info"
         :label="t('backupRestoreOperator.deployment.storage.tip')"

package/components/AlertTable.vue

@@ -82,14 +82,16 @@ export default {
     },
 
     async fetchDeps() {
-      try {
-        const am = await this.$store.dispatch('cluster/find', { type: ENDPOINTS, id: `${ this.monitoringNamespace }/${ this.alertServiceEndpoint }` });
+      if (this.$store.getters['cluster/canList'](ENDPOINTS)) {
+        try {
+          const am = await this.$store.dispatch('cluster/find', { type: ENDPOINTS, id: `${ this.monitoringNamespace }/${ this.alertServiceEndpoint }` });
 
-        if (!isEmpty(am) && !isEmpty(am.subsets)) {
-          this.alertManagerPoller.start();
-        }
-      } catch {
+          if (!isEmpty(am) && !isEmpty(am.subsets)) {
+            this.alertManagerPoller.start();
+          }
+        } catch {
 
+        }
       }
     },
   }

package/components/Carousel.vue

@@ -181,7 +181,7 @@ export default {
               :label="slide.repoName"
               color="slider-badge mb-20"
             />
-            <h1>{{ slide.chartNameDisplay }} {{ i + 1 }}</h1>
+            <h1>{{ slide.chartNameDisplay }}</h1>
             <p>{{ slide.chartDescription }}</p>
           </div>
         </div>
@@ -282,6 +282,7 @@ export default {
   .slide-content {
     display: flex;
     padding: 30px;
+    height: 100%;
 
     .slide-img {
       width: 150px;

package/components/EmberPage.vue

@@ -597,11 +597,11 @@ export default {
 
   .ember-iframe {
     border: 0;
-    left: var(--nav-width);
+    left: calc(var(--nav-width) + $app-bar-collapsed-width);
     height: calc(100vh - var(--header-height));
     position: absolute;
     top: var(--header-height);
-    width: calc(100vw - var(--nav-width));
+    width: calc(100vw - var(--nav-width) - $app-bar-collapsed-width);
     visibility: show;
   }
 

package/components/EtcdInfoBanner.vue

@@ -9,8 +9,18 @@ export default {
   components: { Banner, Loading },
   async fetch() {
     const inStore = this.$store.getters['currentProduct'].inStore;
-    const res = await this.$store.dispatch(`${ inStore }/find`, { type: CATALOG.APP, id: 'cattle-monitoring-system/rancher-monitoring' });
-    const monitoringVersion = res?.currentVersion;
+    let monitoringVersion = '';
+
+    if (this.$store.getters[`${ inStore }/canList}`](CATALOG.APP)) {
+      try {
+        const res = await this.$store.dispatch(`${ inStore }/find`, { type: CATALOG.APP, id: 'cattle-monitoring-system/rancher-monitoring' });
+
+        monitoringVersion = res?.currentVersion;
+      } catch (err) {
+
+      }
+    }
+
     const leader = await hasLeader(monitoringVersion, this.$store.dispatch, this.currentCluster.id);
 
     this.hasLeader = leader ? this.t('generic.yes') : this.t('generic.no');

package/components/GlobalRoleBindings.vue

@@ -94,6 +94,7 @@ export default {
     };
   },
   computed: {
+    ...mapGetters(['releaseNotesUrl']),
     ...mapGetters({ t: 'i18n/t' }),
 
     isCreate() {
@@ -347,6 +348,11 @@ export default {
                     </div>
                   </template>
                 </Checkbox>
+                <p
+                  v-if="role.id === 'restricted-admin'"
+                  v-clean-html="t('rbac.globalRoles.role.restricted-admin.deprecation', { releaseNotesUrl }, true)"
+                  class="deprecation-notice"
+                />
               </div>
             </div>
           </template>
@@ -364,6 +370,10 @@ export default {
 </style>
 <style lang='scss' scoped>
   $detailSize: 11px;
+
+  .deprecation-notice {
+    margin: 8px 0 8px 20px;
+  }
   .role-group {
     .type-title {
       display: flex;

package/components/GrafanaDashboard.vue

@@ -40,13 +40,18 @@ export default {
   },
   async fetch() {
     const inStore = this.$store.getters['currentProduct'].inStore;
-    const res = await this.$store.dispatch(`${ inStore }/find`, { type: CATALOG.APP, id: 'cattle-monitoring-system/rancher-monitoring' });
 
-    this.monitoringVersion = res?.currentVersion;
+    if (this.$store.getters[`${ inStore }/canList`](CATALOG.APP)) {
+      try {
+        const res = await this.$store.dispatch(`${ inStore }/find`, { type: CATALOG.APP, id: 'cattle-monitoring-system/rancher-monitoring' });
+
+        this.monitoringVersion = res?.currentVersion;
+      } catch (err) {}
+    }
   },
   data() {
     return {
-      loading: false, error: false, interval: null, errorTimer: null, monitoringVersion: null
+      loading: false, error: false, interval: null, errorTimer: null, monitoringVersion: ''
     };
   },
   computed: {

package/components/Wizard.vue

@@ -182,6 +182,12 @@ export default {
         this.activeStep = this.visibleSteps[this.initStepIndex];
         this.goToStep(this.activeStepIndex + 1);
       }
+    },
+    errors() {
+      // Ensurce we scroll the errors into view
+      this.$nextTick(() => {
+        this.$refs.wizard.scrollTop = this.$refs.wizard.scrollHeight;
+      });
     }
   },
 
@@ -253,7 +259,10 @@ export default {
 </script>
 
 <template>
-  <div class="outer-container">
+  <div
+    ref="wizard"
+    class="outer-container"
+  >
     <Loading
       v-if="!stepsLoaded"
       mode="relative"
@@ -397,6 +406,7 @@ export default {
             color="error"
             :label="err"
             :closable="true"
+            class="footer-error"
             @close="errors.splice(idx, 1)"
           />
         </div>
@@ -647,6 +657,12 @@ $spacer: 10px;
   }
 }
 
+// We have to account for the absolute position of the .controls-row
+.footer-error {
+  margin-top: -40px;
+  margin-bottom: 70px;
+}
+
   .controls-row {
 
     // Overrides outlet padding

package/components/auth/RoleDetailEdit.vue

@@ -1,4 +1,5 @@
 <script>
+import { mapGetters } from 'vuex';
 import { MANAGEMENT, RBAC } from '@shell/config/types';
 import CruResource from '@shell/components/CruResource';
 import CreateEditView from '@shell/mixins/create-edit-view';
@@ -14,6 +15,7 @@ import { ucFirst } from '@shell/utils/string';
 import SortableTable from '@shell/components/SortableTable';
 import { _CLONE, _DETAIL } from '@shell/config/query-params';
 import { SCOPED_RESOURCES } from '@shell/config/roles';
+import { Banner } from '@components/Banner';
 
 import { SUBTYPE_MAPPING, VERBS } from '@shell/models/management.cattle.io.roletemplate';
 import Loading from '@shell/components/Loading';
@@ -60,7 +62,8 @@ export default {
     Tabbed,
     SortableTable,
     Loading,
-    Error
+    Error,
+    Banner
   },
 
   mixins: [CreateEditView, FormValidation],
@@ -162,6 +165,12 @@ export default {
   },
 
   computed: {
+    ...mapGetters(['releaseNotesUrl']),
+
+    showRestrictedAdminDeprecationBanner() {
+      return this.value.subtype === GLOBAL && this.value.id === 'restricted-admin';
+    },
+
     label() {
       return this.t(`rbac.roletemplate.subtypes.${ this.value.subtype }.label`);
     },
@@ -541,6 +550,13 @@ export default {
     @finish="save"
     @cancel="cancel"
   >
+    <Banner
+      v-if="showRestrictedAdminDeprecationBanner"
+      color="warning"
+      class="mb-20"
+    >
+      <span v-clean-html="t('rbac.globalRoles.role.restricted-admin.deprecation', { releaseNotesUrl }, true)" />
+    </Banner>
     <template v-if="isDetail">
       <SortableTable
         key-field="index"

package/components/form/ArrayList.vue

@@ -164,6 +164,10 @@ export default {
       removeAt(this.rows, index);
       this.queueUpdate();
     },
+
+    /**
+     * Cleanup rows and emit input
+     */
     update() {
       if ( this.isView ) {
         return;
@@ -180,22 +184,24 @@ export default {
       }
       this.$emit('input', out);
     },
+
+    /**
+     * Handle paste event, e.g. split multiple lines in rows
+     */
     onPaste(index, event) {
-      if (this.valueMultiline) {
-        return;
-      }
       event.preventDefault();
       const text = event.clipboardData.getData('text/plain');
-      const split = text.split('\n').map((value) => ({ value }));
-
-      if (split.length === 1) {
-        // It's not multi-line, so don't treat it as such
-        return;
-      }
 
-      event.preventDefault();
+      if (this.valueMultiline) {
+        // Allow to paste multiple lines
+        this.rows[index].value = text;
+      } else {
+        // Prevent to paste the value and emit text in multiple rows
+        const split = text.split('\n').map((value) => ({ value }));
 
-      this.rows.splice(index, 1, ...split);
+        event.preventDefault();
+        this.rows.splice(index, 1, ...split);
+      }
 
       this.update();
     }
@@ -256,6 +262,7 @@ export default {
                 v-if="valueMultiline"
                 ref="value"
                 v-model="row.value"
+                :data-testid="`textarea-${idx}`"
                 :placeholder="valuePlaceholder"
                 :mode="mode"
                 :disabled="disabled"
@@ -266,6 +273,7 @@ export default {
                 v-else-if="rules.length > 0"
                 ref="value"
                 v-model="row.value"
+                :data-testid="`labeled-input-${idx}`"
                 :placeholder="valuePlaceholder"
                 :disabled="isView || disabled"
                 :rules="rules"
@@ -277,6 +285,7 @@ export default {
                 v-else
                 ref="value"
                 v-model="row.value"
+                :data-testid="`input-${idx}`"
                 :placeholder="valuePlaceholder"
                 :disabled="isView || disabled"
                 @paste="onPaste(idx, $event)"