@rancher/shell 1.2.3 → 2.0.1

package/config/product/manager.js

@@ -4,9 +4,11 @@ import {
   CATALOG,
   NORMAN,
   HCI,
-  MANAGEMENT
+  MANAGEMENT,
+  SNAPSHOT,
+  VIRTUAL_TYPES
 } from '@shell/config/types';
-import { MULTI_CLUSTER } from '@shell/store/features';
+import { MULTI_CLUSTER, RKE1_UI } from '@shell/store/features';
 import { DSL } from '@shell/store/type-map';
 import { BLANK_CLUSTER } from '@shell/store/store-types.js';
 
@@ -30,6 +32,7 @@ export function init(store) {
     icon:                'cluster-management',
     removable:           false,
     showClusterSwitcher: false,
+    weight:              -1, // Place at the top
     to:                  {
       name:   'c-cluster-product-resource',
       params: {
@@ -39,8 +42,11 @@ export function init(store) {
       }
     },
     typeStoreMap: {
-      [NORMAN.CLOUD_CREDENTIAL]: 'rancher',
-      cloudCredential:           'rancher',
+      [NORMAN.CLOUD_CREDENTIAL]:          'rancher',
+      cloudCredential:                    'rancher',
+      [NORMAN.KONTAINER_DRIVER]:          'rancher',
+      [NORMAN.NODE_DRIVER]:               'rancher',
+      [VIRTUAL_TYPES.JWT_AUTHENTICATION]: 'management',
     }
   });
 
@@ -54,24 +60,15 @@ export function init(store) {
     route:      { name: 'c-cluster-manager-cloudCredential' },
   });
 
-  virtualType({
-    labelKey:   'legacy.psps',
-    name:       'pod-security-policies',
-    group:      'Root',
-    namespaced: false,
-    weight:     5,
-    icon:       'folder',
-    route:      { name: 'c-cluster-manager-pages-page', params: { cluster: 'local', page: 'pod-security-policies' } },
-    exact:      true
-  });
-
   basicType([
     CAPI.RANCHER_CLUSTER,
     'cloud-credentials',
     'drivers',
-    'pod-security-policies',
   ]);
 
+  configureType(SNAPSHOT, { depaginate: true });
+  configureType(NORMAN.ETCD_BACKUP, { depaginate: true });
+
   configureType(CAPI.RANCHER_CLUSTER, {
     showListMasthead: false, namespaced: false, alias: [HCI.CLUSTER]
   });
@@ -86,16 +83,26 @@ export function init(store) {
   });
 
   virtualType({
-    labelKey:   'manager.drivers.label',
-    name:       'drivers',
+    labelKey:   'drivers.kontainer.title',
+    name:       'rke-kontainer-drivers',
+    group:      'Root',
+    namespaced: false,
+    icon:       'globe',
+    route:      { name: 'c-cluster-manager-driver-kontainerdriver' },
+    exact:      true
+  });
+  virtualType({
+    labelKey:   'drivers.node.title',
+    name:       'rke-node-drivers',
     group:      'Root',
     namespaced: false,
     icon:       'globe',
-    route:      { name: 'c-cluster-manager-pages-page', params: { cluster: 'local', page: 'rke-drivers' } },
+    route:      { name: 'c-cluster-manager-driver-nodedriver' },
     exact:      true
   });
 
   virtualType({
+    ifFeature:  RKE1_UI,
     labelKey:   'manager.rkeTemplates.label',
     name:       'rke-templates',
     group:      'Root',
@@ -106,6 +113,7 @@ export function init(store) {
   });
 
   virtualType({
+    ifFeature:  RKE1_UI,
     labelKey:   'manager.nodeTemplates.label',
     name:       'rke-node-templates',
     group:      'Root',
@@ -115,24 +123,40 @@ export function init(store) {
     exact:      true
   });
 
+  virtualType({
+    labelKey:   'manager.jwtAuthentication.label',
+    name:       VIRTUAL_TYPES.JWT_AUTHENTICATION,
+    group:      'Root',
+    namespaced: false,
+    icon:       'globe',
+    route:      { name: 'c-cluster-manager-jwt-authentication' },
+    exact:      true
+  });
+
+  basicType([
+    'rke-kontainer-drivers',
+    'rke-node-drivers',
+  ], 'drivers');
+
   basicType([
     'rke-templates',
     'rke-node-templates'
   ], 'RKE1Configuration');
 
-  weightType(CAPI.MACHINE_DEPLOYMENT, 3, true);
-  weightType(CAPI.MACHINE_SET, 2, true);
-  weightType(CAPI.MACHINE, 1, true);
-  weightType(CATALOG.CLUSTER_REPO, 0, true);
+  weightType(CAPI.MACHINE_DEPLOYMENT, 4, true);
+  weightType(CAPI.MACHINE_SET, 3, true);
+  weightType(CAPI.MACHINE, 2, true);
+  weightType(CATALOG.CLUSTER_REPO, 1, true);
   weightType(MANAGEMENT.PSA, 5, true);
+  weightType(VIRTUAL_TYPES.JWT_AUTHENTICATION, 0, true);
 
   basicType([
     CAPI.MACHINE_DEPLOYMENT,
     CAPI.MACHINE_SET,
     CAPI.MACHINE,
     CATALOG.CLUSTER_REPO,
-    'pod-security-policies',
-    MANAGEMENT.PSA
+    MANAGEMENT.PSA,
+    VIRTUAL_TYPES.JWT_AUTHENTICATION
   ], 'advanced');
 
   weightGroup('advanced', -1, true);
@@ -160,6 +184,7 @@ export function init(store) {
     {
       name:     'kubernetesVersion',
       labelKey: 'tableHeaders.version',
+      subLabel: 'Architecture',
       value:    'kubernetesVersion',
       sort:     'kubernetesVersion',
       search:   'kubernetesVersion',
@@ -167,6 +192,7 @@ export function init(store) {
     {
       name:      'provider',
       labelKey:  'tableHeaders.provider',
+      subLabel:  'Distro',
       value:     'machineProvider',
       sort:      ['machineProvider', 'provisioner'],
       formatter: 'ClusterProvider',

package/config/query-params.js

@@ -6,6 +6,7 @@ export const LOCAL = 'local';
 export const SETUP = 'setup';
 export const STEP = 'step';
 export const LOGGED_OUT = 'logged-out';
+export const IS_SSO = 'is-sso';
 export const UPGRADED = 'upgraded';
 export const TIMED_OUT = 'timed-out';
 export const AUTH_TEST = 'test';
@@ -50,6 +51,7 @@ export const _SPLIT = 'split';
 
 // CruResource
 export const SUB_TYPE = 'type';
+export const RKE_TYPE = 'rkeType';
 
 // App launch
 export const REPO_TYPE = 'repo-type';

package/config/roles.ts

@@ -198,6 +198,15 @@ export const SCOPED_RESOURCES = {
         'StorageClasses',
         'VolumeAttachments',
       ]
+    },
+    neuvectorApi: {
+      resources: [
+        'nv-perm.admctrl',
+        'nv-perm.authentication',
+        'nv-perm.ci-scan',
+        'nv-perm.fed',
+        'nv-perm.vulnerability'
+      ]
     }
   },
   projectScopedApiGroups: {
@@ -366,6 +375,20 @@ export const SCOPED_RESOURCES = {
         'WorkloadEntries',
         'WorkloadGroups'
       ]
+    },
+    neuvectorApi: {
+      resources: [
+        'nv-perm.all-permissions',
+        'nv-perm.audit-events',
+        'nv-perm.authorization',
+        'nv-perm.compliance',
+        'nv-perm.events',
+        'nv-perm.reg-scan',
+        'nv-perm.rt-policy',
+        'nv-perm.rt-scan',
+        'nv-perm.security-events',
+        'nv-perm.config',
+      ]
     }
   }
 };

package/config/router/index.js

@@ -0,0 +1,23 @@
+import Vue from 'vue';
+import Router from 'vue-router';
+import Routes from '@shell/config/router/routes';
+import { installNavigationGuards } from '@shell/config/router/navigation-guards';
+
+Vue.use(Router);
+
+export const routerOptions = {
+  mode:     'history',
+  // Note: router base comes from the ROUTER_BASE env var
+  base:     process.env.routerBase || '/',
+  routes:   Routes,
+  fallback: false
+};
+
+export function extendRouter(config, context) {
+  const base = (config._app && config._app.basePath) || routerOptions.base;
+  const router = new Router({ ...routerOptions, base });
+
+  installNavigationGuards(router, context);
+
+  return router;
+}

package/config/router/navigation-guards/attempt-first-login.js

@@ -0,0 +1,73 @@
+import { SETUP } from '@shell/config/query-params';
+import { SETTING } from '@shell/config/settings';
+import { MANAGEMENT, NORMAN } from '@shell/config/types';
+import { tryInitialSetup } from '@shell/utils/auth';
+import { routeRequiresAuthentication } from '@shell/utils/router';
+
+export function install(router, context) {
+  router.beforeEach((to, from, next) => attemptFirstLogin(to, from, next, context));
+}
+
+export async function attemptFirstLogin(to, from, next, { store }) {
+  if (!routeRequiresAuthentication(to)) {
+    return next();
+  }
+
+  // Initial ?setup=admin-password can technically be on any route
+  let initialPass = to.query[SETUP];
+  let firstLogin = null;
+
+  try {
+    const res = store.getters['management/byId'](MANAGEMENT.SETTING, SETTING.FIRST_LOGIN);
+    const plSetting = store.getters['management/byId'](MANAGEMENT.SETTING, SETTING.PL);
+
+    firstLogin = res?.value === 'true';
+
+    if (!initialPass && plSetting?.value === 'Harvester') {
+      initialPass = 'admin';
+    }
+  } catch (e) {
+    console.error('Failed looking up first login setting', e); // eslint-disable-line no-console
+  }
+
+  if ( firstLogin === null ) {
+    try {
+      const res = await store.dispatch('rancher/find', {
+        type: NORMAN.SETTING,
+        id:   SETTING.FIRST_LOGIN,
+        opt:  { url: `/v3/settings/${ SETTING.FIRST_LOGIN }` }
+      });
+
+      firstLogin = res?.value === 'true';
+
+      const plSetting = await store.dispatch('rancher/find', {
+        type: NORMAN.SETTING,
+        id:   SETTING.PL,
+        opt:  { url: `/v3/settings/${ SETTING.PL }` }
+      });
+
+      if (!initialPass && plSetting?.value === 'Harvester') {
+        initialPass = 'admin';
+      }
+    } catch (e) {
+      console.error('Failed looking up first login setting', e); // eslint-disable-line no-console
+    }
+  }
+
+  // TODO show error if firstLogin and default pass doesn't work
+  if ( firstLogin ) {
+    const ok = await tryInitialSetup(store, initialPass);
+
+    if (ok) {
+      if (initialPass) {
+        store.dispatch('auth/setInitialPass', initialPass);
+      }
+
+      return next({ name: 'auth-setup' });
+    } else {
+      return next({ name: 'auth-login' });
+    }
+  }
+
+  next();
+}

package/config/router/navigation-guards/authentication.js

@@ -0,0 +1,63 @@
+import { routeRequiresAuthentication } from '@shell/utils/router';
+import { isLoggedIn, notLoggedIn, noAuth, findMe } from '@shell/utils/auth';
+
+export function install(router, context) {
+  router.beforeEach((to, from, next) => authenticate(to, from, next, context));
+}
+
+export async function authenticate(to, from, next, { store }) {
+  if (!routeRequiresAuthentication(to)) {
+    return next();
+  }
+
+  if ( store.getters['auth/enabled'] !== false && !store.getters['auth/loggedIn'] ) {
+    // `await` so we have one successfully request whilst possibly logged in (ensures fromHeader is populated from `x-api-cattle-auth`)
+    await store.dispatch('auth/getUser');
+
+    const v3User = store.getters['auth/v3User'] || {};
+
+    if (v3User?.mustChangePassword) {
+      return next({ name: 'auth-setup' });
+    }
+
+    // In newer versions the API calls return the auth state instead of having to make a new call all the time.
+    const fromHeader = store.getters['auth/fromHeader'];
+
+    if ( fromHeader === 'none' ) {
+      noAuth(store);
+    } else if ( fromHeader === 'true' ) {
+      const me = await findMe(store);
+
+      isLoggedIn(store, me);
+    } else if ( fromHeader === 'false' ) {
+      notLoggedIn(store, next, to);
+
+      return;
+    } else {
+      // Older versions look at principals and see what happens
+      try {
+        const me = await findMe(store);
+
+        isLoggedIn(store, me);
+      } catch (e) {
+        const status = e?._status;
+
+        if ( status === 404 ) {
+          noAuth(store);
+        } else {
+          if ( status === 401 ) {
+            notLoggedIn(store, next, to);
+          } else {
+            store.commit('setError', { error: e, locationError: new Error('Auth Middleware') });
+          }
+
+          return;
+        }
+      }
+    }
+
+    store.dispatch('gcStartIntervals');
+  }
+
+  next();
+}

package/config/router/navigation-guards/i18n.js

@@ -0,0 +1,13 @@
+export function install(router, context) {
+  router.beforeEach((to, from, next) => loadI18n(to, from, next, context));
+}
+
+export async function loadI18n(to, from, next, { store }) {
+  try {
+    await store.dispatch('i18n/init');
+  } catch (e) {
+    console.error('Failed to initialize i18n', e); // eslint-disable-line no-console
+  }
+
+  next();
+}

package/config/router/navigation-guards/index.js

@@ -0,0 +1,16 @@
+import { install as installLoadInitialSettings } from '@shell/config/router/navigation-guards/load-initial-settings';
+import { install as installAttemptFirstLogin } from '@shell/config/router/navigation-guards/attempt-first-login';
+import { install as installAuthentication } from '@shell/config/router/navigation-guards/authentication';
+import { install as installI18N } from '@shell/config/router/navigation-guards/i18n';
+
+/**
+ * Install our router navigation guards. i.e. router.beforeEach(), router.afterEach()
+ */
+export function installNavigationGuards(router, context) {
+  // NOTE: the order of the installation matters.
+  // Be intentional when adding, removing or modifying the guards that are installed.
+
+  const navigationGuardInstallers = [installLoadInitialSettings, installAttemptFirstLogin, installAuthentication, installI18N];
+
+  navigationGuardInstallers.forEach((installer) => installer(router, context));
+}

package/config/router/navigation-guards/load-initial-settings.js

@@ -0,0 +1,15 @@
+import { fetchInitialSettings } from '@shell/utils/settings';
+
+export function install(router, context) {
+  router.beforeEach((to, from, next) => loadInitialSettings(to, from, next, context));
+}
+
+export async function loadInitialSettings(to, from, next, { store }) {
+  try {
+    await fetchInitialSettings(store);
+  } catch (e) {
+    console.error('Failed fetching initial settings', e); // eslint-disable-line no-console
+  }
+
+  next();
+}