@rancher/shell 0.3.3 → 0.3.5

package/edit/management.cattle.io.fleetworkspace.vue

@@ -4,12 +4,18 @@ import CruResource from '@shell/components/CruResource';
 import Labels from '@shell/components/form/Labels';
 import Loading from '@shell/components/Loading';
 import NameNsDescription from '@shell/components/form/NameNsDescription';
-import { FLEET, MANAGEMENT } from '@shell/config/types';
+import { FLEET, MANAGEMENT, SCHEMA } from '@shell/config/types';
 // import RoleBindings from '@shell/components/RoleBindings';
 import Tabbed from '@shell/components/Tabbed';
 import Tab from '@shell/components/Tabbed/Tab';
 import { SCOPE_NAMESPACE, SCOPE_CLUSTER } from '@shell/components/RoleBindings.vue';
 import { NAME as FLEET_NAME } from '@shell/config/product/fleet';
+// import KeyValue from '@shell/components/form/KeyValue.vue';
+import { mapState } from 'vuex';
+import { LAST_NAMESPACE, WORKSPACE } from '@shell/store/prefs';
+import { exceptionToErrorsArray } from '@shell/utils/error';
+import Banner from '@components/Banner/Banner.vue';
+import ArrayList from '@shell/components/form/ArrayList.vue';
 
 export default {
   name: 'FleetCruWorkspace',
@@ -19,26 +25,123 @@ export default {
     Labels,
     Loading,
     NameNsDescription,
-    // RoleBindings,
     Tabbed,
     Tab,
+    Banner,
+    ArrayList
   },
 
   mixins: [CreateEditView],
 
   async fetch() {
     this.rancherClusters = await this.$store.dispatch('management/findAll', { type: MANAGEMENT.CLUSTER });
-    this.fleetClusters = await this.$store.dispatch('management/findAll', { type: FLEET.CLUSTER });
+
+    if (this.$store.getters['management/schemaFor']( FLEET.CLUSTER )) {
+      this.fleetClusters = await this.$store.dispatch('management/findAll', { type: FLEET.CLUSTER });
+    }
+
+    if (this.hasRepoRestrictionSchema) {
+      const restrictions = await this.$store.dispatch('management/findAll', { type: FLEET.GIT_REPO_RESTRICTION });
+
+      const workSpaceRestriction = restrictions.find((item) => {
+        return item.metadata.namespace === this.value.metadata.name && item.metadata.name.startsWith(`restriction-${ this.value.metadata.name }`);
+      });
+
+      if (workSpaceRestriction) {
+        this.workSpaceRestriction = workSpaceRestriction;
+      }
+    }
+
+    this.restrictionsOptions = await this.$store.getters[`type-map/optionsFor`](FLEET.GIT_REPO_RESTRICTION);
+    this.restrictionsSchema = await this.$store.getters[`management/schemaFor`](FLEET.GIT_REPO_RESTRICTION);
   },
 
   data() {
+    this.$set(this.value, 'spec', this.value.spec || {});
+
     return {
-      fleetClusters:   null,
-      rancherClusters: null,
+      fleetClusters:            null,
+      rancherClusters:          null,
+      workSpaceRestriction:     null,
+      restrictions:             [],
+      targetNamespaces:         [],
+      restrictionsSchema:       { spec: {} },
+      namespace:                this.$store.getters['prefs/get'](LAST_NAMESPACE),
+      hasRepoRestrictionSchema: !!this.$store.getters['management/schemaFor']( FLEET.GIT_REPO_RESTRICTION )
     };
   },
 
+  methods: {
+    async saveAll(buttonCb) {
+      // Anyone who can edit workspace
+
+      try {
+        await this.value.save();
+
+        // IF there is a restriction update it
+        if (this.workSpaceRestriction) {
+          await this.workSpaceRestriction.save();
+        }
+
+        // If there is no restriction and targetnamespace is set then create it.
+        if (!this.workSpaceRestriction && this.targetNamespaces.length) {
+          // For users with more limited permissions the gitreporestriction schema may not be visible until they create a workspace
+          if (!this.hasRepoRestrictionSchema) {
+            await this.$store.dispatch('management/find', { type: SCHEMA, id: FLEET.GIT_REPO_RESTRICTION }, { force: true });
+          }
+          const model = await this.$store.dispatch(`management/create`, {
+            type:                    FLEET.GIT_REPO_RESTRICTION,
+            allowedTargetNamespaces: this.targetNamespaces,
+            metadata:                {
+              // restriction- prefix is added to the workspace name
+              // to identify automatically created GitRepoRestrictions
+              // when adding targetNamespaces at the point of workspace creation
+              name:      `restriction-${ this.value.metadata.name }-${ Date.now() }`,
+              namespace: this.value.metadata.name // what the user types
+            }
+          });
+
+          await model.save();
+        }
+
+        await this.value.waitForWorkspaceSchema(20000, (schema) => {
+          // For standard user if there are no workspaces, user can't list workspaces
+          // Therefore wait for it.
+          return schema.collectionMethods?.includes('GET');
+        });
+
+        await this.$store.dispatch( 'management/findAll', { type: FLEET.WORKSPACE });
+
+        this.$store.commit('updateWorkspace', { value: this.value.metadata.name, getters: this.$store.getters } );
+        this.$store.dispatch('prefs/set', { key: WORKSPACE, value: this.value.metadata.name });
+
+        buttonCb(true);
+        this.done();
+      } catch (err) {
+        console.error(err) ; // eslint-disable-line no-console
+        buttonCb(false);
+        this.errors = exceptionToErrorsArray(err);
+      }
+    },
+  },
+
   computed: {
+    ...mapState(['allWorkspaces', 'workspace']),
+
+    allowedTargetNamespaces: {
+      get() {
+        return this.workSpaceRestriction?.allowedTargetNamespaces || [];
+      },
+
+      set(value) {
+        if (this.workSpaceRestriction) {
+          this.workSpaceRestriction.allowedTargetNamespaces = value;
+        }
+
+        this.targetNamespaces = value;
+      }
+    },
+
     SCOPE_NAMESPACE() {
       return SCOPE_NAMESPACE;
     },
@@ -65,7 +168,7 @@ export default {
     :validation-passed="true"
     :errors="errors"
     @error="e=>errors = e"
-    @finish="save"
+    @finish="saveAll"
     @cancel="done"
   >
     <NameNsDescription
@@ -100,6 +203,38 @@ export default {
           :mode="mode"
         />
       </Tab>
+      <Tab
+        name="allowedtargetnamespaces"
+        label-key="fleet.workspaces.tabs.restrictions"
+      >
+        <Banner
+          color="info"
+        >
+          <div>
+            <t
+              k="fleet.restrictions.banner"
+              :count="allowedTargetNamespaces.length"
+              :raw="true"
+            />
+            <a
+              v-if="!!allowedTargetNamespaces.length"
+              @click="workSpaceRestriction.goToDetail()"
+            >
+              {{ t('generic.here') }}
+            </a>
+          </div>
+        </Banner>
+
+        <ArrayList
+          key="labels"
+          v-model="allowedTargetNamespaces"
+          :add-label="t('fleet.restrictions.addLabel')"
+          :mode="mode"
+          :title="t('fleet.restrictions.addTitle')"
+          :read-allowed="false"
+          :value-can-be-empty="true"
+        />
+      </Tab>
     </Tabbed>
   </CruResource>
 </template>

package/edit/management.cattle.io.podsecurityadmissionconfigurationtemplate.vue

@@ -86,15 +86,18 @@ export default (Vue as VueConstructor<Vue & InstanceType<typeof CreateEditView>>
     :resource="value"
     :errors="errors"
     :cancel-event="true"
+    :done-route="doneRoute"
     @error="setErrors"
     @finish="save"
-    @cancel="done()"
+    @cancel="done"
   >
     <NameNsDescription
       :value="value"
       :namespaced="false"
       :mode="mode"
+      description-key="description"
     />
+
     <PodSecurityAdmission
       :labels="defaults"
       :labels-always-active="true"

package/edit/management.cattle.io.setting.vue

@@ -122,8 +122,8 @@ export default {
 
     <h5
       v-if="editHelp"
+      v-clean-html="editHelp"
       class="edit-help"
-      v-html="editHelp"
     />
 
     <div class="edit-change mt-20">

package/edit/monitoring.coreos.com.alertmanagerconfig/types/webhook.vue

@@ -143,8 +143,8 @@ export default {
   <div>
     <Banner
       v-if="mode !== view"
+      v-clean-html="t('monitoringReceiver.webhook.banner', {}, raw=true)"
       color="info"
-      v-html="t('monitoringReceiver.webhook.banner', {}, raw=true)"
     />
     <div class="row mb-20">
       <LabeledSelect
@@ -166,8 +166,8 @@ export default {
     </div>
     <Banner
       v-if="showNamespaceBanner"
+      v-clean-html="t('monitoringReceiver.webhook.modifyNamespace', {}, raw=true)"
       color="info"
-      v-html="t('monitoringReceiver.webhook.modifyNamespace', {}, raw=true)"
     />
     <div class="row mb-20">
       <div class="col span-12">

package/edit/monitoring.coreos.com.receiver/tls.vue

@@ -35,37 +35,37 @@ export default {
     <div class="row">
       <div class="col span-12">
         <h3>{{ t('monitoring.receiver.tls.label') }}</h3>
-        <Banner
-          color="info"
-          v-html="t('monitoring.receiver.tls.secretsBanner', {}, true)"
+        <Banner
+          v-clean-html="t('monitoring.receiver.tls.secretsBanner', {}, true)"
+          color="info"
         />
       </div>
     </div>
     <div class="row mb-20">
       <div class="col span-6">
-        <LabeledInput
-          v-model="value.tls_config.ca_file"
-          :mode="mode"
-          :label="t('monitoring.receiver.tls.caFilePath.label')"
-          :placeholder="t('monitoring.receiver.tls.caFilePath.placeholder')"
+        <LabeledInput
+          v-model="value.tls_config.ca_file"
+          :mode="mode"
+          :label="t('monitoring.receiver.tls.caFilePath.label')"
+          :placeholder="t('monitoring.receiver.tls.caFilePath.placeholder')"
         />
       </div>
     </div>
     <div class="row mb-20">
       <div class="col span-6">
-        <LabeledInput
-          v-model="value.tls_config.cert_file"
-          :mode="mode"
-          :label="t('monitoring.receiver.tls.certFilePath.label')"
-          :placeholder="t('monitoring.receiver.tls.certFilePath.placeholder')"
+        <LabeledInput
+          v-model="value.tls_config.cert_file"
+          :mode="mode"
+          :label="t('monitoring.receiver.tls.certFilePath.label')"
+          :placeholder="t('monitoring.receiver.tls.certFilePath.placeholder')"
         />
       </div>
       <div class="col span-6">
-        <LabeledInput
-          v-model="value.tls_config.key_file"
-          :mode="mode"
-          :label="t('monitoring.receiver.tls.keyFilePath.label')"
-          :placeholder="t('monitoring.receiver.tls.keyFilePath.placeholder')"
+        <LabeledInput
+          v-model="value.tls_config.key_file"
+          :mode="mode"
+          :label="t('monitoring.receiver.tls.keyFilePath.label')"
+          :placeholder="t('monitoring.receiver.tls.keyFilePath.placeholder')"
         />
       </div>
     </div>

package/edit/monitoring.coreos.com.receiver/types/webhook.banner.vue

@@ -20,9 +20,9 @@ export default {
 };
 </script>
 <template>
-  <Banner
-    v-if="model.length === 0 && !isView"
-    color="info"
-    v-html="t('monitoringReceiver.webhook.banner', {}, raw=true)"
+  <Banner
+    v-if="model.length === 0 && !isView"
+    v-clean-html="t('monitoringReceiver.webhook.banner', {}, raw=true)"
+    color="info"
   />
 </template>

package/edit/monitoring.coreos.com.receiver/types/webhook.vue

@@ -50,8 +50,8 @@ export default {
     </div>
     <Banner
       v-if="showNamespaceBanner"
+      v-clean-html="t('monitoringReceiver.webhook.modifyNamespace', {}, raw=true)"
       color="info"
-      v-html="t('monitoringReceiver.webhook.modifyNamespace', {}, raw=true)"
     />
     <div class="row mb-20">
       <div class="col span-12">

package/edit/namespace.vue

@@ -108,8 +108,8 @@ export default {
   },
 
   watch: {
-    project(newProject) {
-      const limits = this.getDefaultContainerResourceLimits(newProject);
+    project() {
+      const limits = this.getDefaultContainerResourceLimits(this.projectName);
 
       this.$set(this, 'containerResourceLimits', limits);
     },

package/edit/networking.k8s.io.networkpolicy/PolicyRuleTarget.vue

@@ -11,9 +11,12 @@ import { Banner } from '@components/Banner';
 import throttle from 'lodash/throttle';
 import { isValidCIDR } from '@shell/utils/validators/cidr';
 
-const TARGET_OPTION_IP_BLOCK = 'ipBlock';
-const TARGET_OPTION_NAMESPACE_SELECTOR = 'namespaceSelector';
-const TARGET_OPTION_POD_SELECTOR = 'podSelector';
+const TARGET_OPTIONS = {
+  IP_BLOCK:                   'ipBlock',
+  NAMESPACE_SELECTOR:         'namespaceSelector',
+  POD_SELECTOR:               'podSelector',
+  NAMESPACE_AND_POD_SELECTOR: 'namespaceAndPodSelector',
+};
 
 export default {
   components: {
@@ -52,53 +55,48 @@ export default {
     },
   },
   data() {
-    if (!this.value[TARGET_OPTION_IP_BLOCK] && !this.value[TARGET_OPTION_POD_SELECTOR] && !this.value[TARGET_OPTION_NAMESPACE_SELECTOR]) {
+    if (!this.value[TARGET_OPTIONS.IP_BLOCK] &&
+      !this.value[TARGET_OPTIONS.POD_SELECTOR] &&
+      !this.value[TARGET_OPTIONS.NAMESPACE_SELECTOR] &&
+      !this.value[TARGET_OPTIONS.NAMESPACE_AND_POD_SELECTOR]
+    ) {
       this.$nextTick(() => {
-        this.$set(this.value, TARGET_OPTION_IP_BLOCK, {});
+        this.$set(this.value, TARGET_OPTIONS.IP_BLOCK, {});
       });
     }
 
-    const matchingPods = this.getMatchingPods();
-    const matchingNamespaces = this.getMatchingNamespaces();
-
     return {
-      portOptions:   ['TCP', 'UDP'],
-      matchingPods,
-      matchingNamespaces,
-      invalidCidr:   null,
-      invalidCidrs:  [],
-      TARGET_OPTION_IP_BLOCK,
-      TARGET_OPTION_NAMESPACE_SELECTOR,
-      TARGET_OPTION_POD_SELECTOR,
+      portOptions:        ['TCP', 'UDP'],
+      matchingPods:       {},
+      matchingNamespaces: {},
+      invalidCidr:        null,
+      invalidCidrs:       [],
       POD,
-      targetOptions: [
-        TARGET_OPTION_IP_BLOCK,
-        TARGET_OPTION_NAMESPACE_SELECTOR,
-        TARGET_OPTION_POD_SELECTOR
-      ],
+      TARGET_OPTIONS,
+      targetOptions:      Object.values(TARGET_OPTIONS),
     };
   },
   computed: {
     podSelectorExpressions: {
       get() {
         return convert(
-          this.value[TARGET_OPTION_POD_SELECTOR]?.matchLabels || {},
-          this.value[TARGET_OPTION_POD_SELECTOR]?.matchExpressions || []
+          this.value[TARGET_OPTIONS.POD_SELECTOR]?.matchLabels || {},
+          this.value[TARGET_OPTIONS.POD_SELECTOR]?.matchExpressions || []
         );
       },
       set(podSelectorExpressions) {
-        this.$set(this.value, TARGET_OPTION_POD_SELECTOR, simplify(podSelectorExpressions));
+        this.$set(this.value, TARGET_OPTIONS.POD_SELECTOR, simplify(podSelectorExpressions));
       }
     },
     namespaceSelectorExpressions: {
       get() {
         return convert(
-          this.value[TARGET_OPTION_NAMESPACE_SELECTOR]?.matchLabels || {},
-          this.value[TARGET_OPTION_NAMESPACE_SELECTOR]?.matchExpressions || []
+          this.value[TARGET_OPTIONS.NAMESPACE_SELECTOR]?.matchLabels || {},
+          this.value[TARGET_OPTIONS.NAMESPACE_SELECTOR]?.matchExpressions || []
         );
       },
       set(namespaceSelectorExpressions) {
-        this.$set(this.value, TARGET_OPTION_NAMESPACE_SELECTOR, simplify(namespaceSelectorExpressions));
+        this.$set(this.value, TARGET_OPTIONS.NAMESPACE_SELECTOR, simplify(namespaceSelectorExpressions));
       }
     },
     selectTargetOptions() {
@@ -116,6 +114,9 @@ export default {
     targetType: {
       get() {
         for (const option of this.targetOptions) {
+          if (this.value[TARGET_OPTIONS.NAMESPACE_AND_POD_SELECTOR] || (this.value[TARGET_OPTIONS.NAMESPACE_SELECTOR] && this.value[TARGET_OPTIONS.POD_SELECTOR])) {
+            return TARGET_OPTIONS.NAMESPACE_AND_POD_SELECTOR;
+          }
           if (this.value[option]) {
             return option;
           }
@@ -124,13 +125,30 @@ export default {
         return null;
       },
       set(targetType) {
-        this.$delete(this.value, TARGET_OPTION_IP_BLOCK);
-        this.$delete(this.value, TARGET_OPTION_NAMESPACE_SELECTOR);
-        this.$delete(this.value, TARGET_OPTION_POD_SELECTOR);
+        this.$delete(this.value, TARGET_OPTIONS.IP_BLOCK);
+        this.$delete(this.value, TARGET_OPTIONS.NAMESPACE_SELECTOR);
+        this.$delete(this.value, TARGET_OPTIONS.POD_SELECTOR);
+        this.$delete(this.value, TARGET_OPTIONS.NAMESPACE_AND_POD_SELECTOR);
         this.$nextTick(() => {
           this.$set(this.value, targetType, {});
         });
       }
+    },
+    updateMatches() {
+      return {
+        handler: throttle(function() {
+          this.matchingNamespaces = this.getMatchingNamespaces();
+          this.matchingPods = this.getMatchingPods();
+        }, 250, { leading: true }),
+        immediate: true
+      };
+    },
+    matchingNamespacesAndPods() {
+      return {
+        policyNamespace: this.namespace,
+        ...Object.keys(this.matchingNamespaces).reduce((acc, k) => ({ ...acc, [`${ k }Namespaces`]: this.matchingNamespaces[k] }), {}),
+        ...Object.keys(this.matchingPods).reduce((acc, k) => ({ ...acc, [`${ k }Pods`]: this.matchingPods[k] }), {}),
+      };
     }
   },
   watch: {
@@ -144,24 +162,21 @@ export default {
   },
   methods: {
     validateCIDR() {
-      const exceptCidrs = this.value[TARGET_OPTION_IP_BLOCK]?.except || [];
+      const exceptCidrs = this.value[TARGET_OPTIONS.IP_BLOCK]?.except || [];
 
       this.invalidCidrs = exceptCidrs
         .filter(cidr => !isValidCIDR(cidr))
         .map(invalidCidr => invalidCidr || '<blank>');
 
-      if (this.value[TARGET_OPTION_IP_BLOCK]?.cidr && !isValidCIDR(this.value[TARGET_OPTION_IP_BLOCK].cidr)) {
-        this.invalidCidr = this.value[TARGET_OPTION_IP_BLOCK].cidr;
+      if (this.value[TARGET_OPTIONS.IP_BLOCK]?.cidr && !isValidCIDR(this.value[TARGET_OPTIONS.IP_BLOCK].cidr)) {
+        this.invalidCidr = this.value[TARGET_OPTIONS.IP_BLOCK].cidr;
       } else {
         this.invalidCidr = null;
       }
     },
-    updateMatches: throttle(function() {
-      this.matchingPods = this.getMatchingPods();
-      this.matchingNamespaces = this.getMatchingNamespaces();
-    }, 250, { leading: true }),
     getMatchingPods() {
-      const allInNamespace = this.allPods.filter(pod => pod.metadata.namespace === this.namespace);
+      const namespaces = this.targetType === TARGET_OPTIONS.NAMESPACE_AND_POD_SELECTOR ? this.matchingNamespaces.matches : [{ id: this.namespace }];
+      const allInNamespace = this.allPods.filter(pod => namespaces.some(ns => ns.id === pod.metadata.namespace));
       const match = matching(allInNamespace, this.podSelectorExpressions);
       const matched = match.length || 0;
       const sample = match[0]?.nameDisplay;
@@ -199,17 +214,18 @@ export default {
         <LabeledSelect
           v-model="targetType"
           :mode="mode"
+          :tooltip="targetType === TARGET_OPTIONS.NAMESPACE_AND_POD_SELECTOR ? t('networkpolicy.selectors.matchingNamespacesAndPods.tooltip') : null"
           :options="selectTargetOptions"
           :multiple="false"
           :label="t('networkpolicy.rules.type')"
         />
       </div>
     </div>
-    <div v-if="targetType === TARGET_OPTION_IP_BLOCK">
+    <div v-if="targetType === TARGET_OPTIONS.IP_BLOCK">
       <div class="row">
         <div class="col span-6">
           <LabeledInput
-            v-model="value[TARGET_OPTION_IP_BLOCK].cidr"
+            v-model="value[TARGET_OPTIONS.IP_BLOCK].cidr"
             :mode="mode"
             :placeholder="t('networkpolicy.rules.ipBlock.cidr.placeholder')"
             :label="t('networkpolicy.rules.ipBlock.cidr.label')"
@@ -229,7 +245,7 @@ export default {
       <div class="row mt-20">
         <div class="col span-12">
           <ArrayList
-            v-model="value[TARGET_OPTION_IP_BLOCK].except"
+            v-model="value[TARGET_OPTIONS.IP_BLOCK].except"
             :add-label="t('networkpolicy.rules.ipBlock.addExcept')"
             :mode="mode"
             :show-header="true"
@@ -249,11 +265,11 @@ export default {
         </div>
       </div>
     </div>
-    <div v-if="targetType === TARGET_OPTION_POD_SELECTOR">
+    <div v-if="targetType === TARGET_OPTIONS.POD_SELECTOR">
       <div class="row">
         <div class="col span-12">
           <Banner color="success">
-            <span v-html="t('networkpolicy.selectors.matchingPods.matchesSome', matchingPods)" />
+            <span v-clean-html="t('networkpolicy.selectors.matchingPods.matchesSome', matchingPods)" />
           </Banner>
         </div>
       </div>
@@ -269,11 +285,11 @@ export default {
         </div>
       </div>
     </div>
-    <div v-if="targetType === TARGET_OPTION_NAMESPACE_SELECTOR">
+    <div v-if="targetType === TARGET_OPTIONS.NAMESPACE_SELECTOR">
       <div class="row">
         <div class="col span-12">
           <Banner color="success">
-            <span v-html="t('networkpolicy.selectors.matchingNamespaces.matchesSome', matchingNamespaces)" />
+            <span v-clean-html="t('networkpolicy.selectors.matchingNamespaces.matchesSome', matchingNamespaces)" />
           </Banner>
         </div>
       </div>
@@ -289,5 +305,70 @@ export default {
         </div>
       </div>
     </div>
+    <div v-if="targetType === TARGET_OPTIONS.NAMESPACE_AND_POD_SELECTOR">
+      <div class="row">
+        <div class="col span-12">
+          <Banner color="success">
+            <span
+              v-if="!namespaceSelectorExpressions.length"
+              v-clean-html="t('networkpolicy.selectors.matchingPods.matchesSome', matchingPods)"
+            />
+            <span
+              v-else
+              v-clean-html="t('networkpolicy.selectors.matchingNamespacesAndPods.matchesSome', matchingNamespacesAndPods)"
+            />
+          </Banner>
+        </div>
+      </div>
+      <div class="row mb-0">
+        <div class="col span-1 namespace-pod-rule">
+          <span class="label">
+            {{ t('networkpolicy.rules.namespace') }}
+          </span>
+        </div>
+        <div class="col span-11">
+          <MatchExpressions
+            v-model="namespaceSelectorExpressions"
+            :mode="mode"
+            :show-add-button="false"
+            :show-remove-button="false"
+            :show-remove="false"
+            :initial-empty-row="true"
+            :type="POD"
+          />
+        </div>
+      </div>
+      <div class="row mb-0">
+        <div class="col span-1 namespace-pod-rule">
+          <span class="label">
+            {{ t('networkpolicy.rules.pod') }}
+          </span>
+        </div>
+        <div class="col span-11">
+          <MatchExpressions
+            v-model="podSelectorExpressions"
+            :mode="mode"
+            :show-add-button="false"
+            :show-remove-button="false"
+            :show-remove="false"
+            :initial-empty-row="true"
+            :type="POD"
+          />
+        </div>
+      </div>
+    </div>
   </div>
 </template>
+
+<style lang='scss' scoped>
+  .namespace-pod-rule {
+    width: 100px;
+    margin: 0;
+    text-align: center;
+
+    .label {
+      display: block;
+      margin-top: 32px;
+    }
+  }
+</style>

package/edit/networking.k8s.io.networkpolicy/index.vue

@@ -258,7 +258,7 @@ export default {
             <div class="row">
               <div class="col span-12">
                 <Banner color="success">
-                  <span v-html="t('networkpolicy.selectors.matchingPods.matchesSome', matchingPods)" />
+                  <span v-clean-html="t('networkpolicy.selectors.matchingPods.matchesSome', matchingPods)" />
                 </Banner>
               </div>
             </div>

package/edit/provisioning.cattle.io.cluster/MachinePool.vue

@@ -158,6 +158,14 @@ export default {
     // (only used on Elemental because it comes from "machineinventoryselectortemplate" machine-config)
     updateMachineCount(val) {
       this.value.pool.quantity = val || 1;
+    },
+
+    expandAdvanced() {
+      const advancedComponent = this.$refs.advanced;
+
+      if (advancedComponent && !advancedComponent.show) {
+        advancedComponent.toggle();
+      }
     }
   }
 };
@@ -223,6 +231,7 @@ export default {
       :machine-pools="machinePools"
       @error="e=>errors = e"
       @updateMachineCount="updateMachineCount"
+      @expandAdvanced="expandAdvanced"
     />
     <Banner
       v-else-if="value.configMissing"
@@ -236,6 +245,7 @@ export default {
     />
 
     <AdvancedSection
+      ref="advanced"
       :mode="mode"
       class="advanced"
     >