@rancher/shell 3.0.12-rc.4 → 3.0.12-rc.6

package/apis/resources/resources-api-class.ts

@@ -1,9 +1,11 @@
 import {
-  ResourceType, FindMethodOptions, FindAllMethodOptions, FindFilteredPageOptions, FindFilteredLabelSelectorOptions,
-  FindFilteredPageResponse, FindFilteredLabelSelectorResponse
+  ResourceType, CreateResourceData, FindMethodOptions, FindAllMethodOptions, FindFilteredPageOptions, FindFilteredLabelSelectorOptions,
+  FindFilteredPageResponse, FindFilteredLabelSelectorResponse, SteveResource,
+  FindFilteredPageOptionsTransient,
 } from '@shell/apis/intf/resources-api/resource-base';
+import { ResourceInstance } from '@shell/apis/intf/resources-api/resource-instance';
 import { ResourcesApi } from '@shell/apis/intf/resources-api/resources-api';
-import { SteveListResponse, SteveGetResponse } from '@shell/types/rancher/steve.api';
+import { ActionFindPageTransientResponse } from '@shell/types/store/dashboard-store.types';
 import { Store } from 'vuex';
 
 export class ResourcesApiClassImpl implements ResourcesApi {
@@ -11,11 +13,32 @@ export class ResourcesApiClassImpl implements ResourcesApi {
 
   private storeType: 'cluster' | 'management' | string;
 
+  private createLogMessage(message: string, level: 'error' | 'warning' = 'error') {
+    return `Resource API ${ level } - ${ this.storeType } - ${ message }`;
+  }
+
+  private surfaceWarning(message: string, e?: any): void {
+    console.warn(this.createLogMessage(message, 'warning'), e); // eslint-disable-line no-console
+  }
+
   private surfaceError(message: string, e?: any): never {
-    console.error(`Resource API error - ${ this.storeType } - ${ message }`); // eslint-disable-line no-console
+    console.error(this.createLogMessage(message), e); // eslint-disable-line no-console
+
     throw new Error(`Resource API error - ${ this.storeType } - ${ message }`, { cause: e });
   }
 
+  private resourceUrl(resourceType: ResourceType, resourceId?: string): string {
+    if (this.isNamespaced(resourceType) && resourceId && !resourceId.includes('/')) {
+      if (!resourceId) {
+        this.surfaceError(`Resource "${ resourceType }" is namespaced`);
+      } else {
+        this.surfaceError(`Resource "${ resourceType }" is namespaced. The resourceId must be in "namespace/name" format, but received "${ resourceId }"`);
+      }
+    }
+
+    return this.store.getters[`${ this.storeType }/urlFor`](resourceType, resourceId);
+  }
+
   private isNamespaced(resourceType: ResourceType): boolean {
     const schema = this.store.getters[`${ this.storeType }/schemaFor`]?.(resourceType);
 
@@ -30,8 +53,9 @@ export class ResourcesApiClassImpl implements ResourcesApi {
   /**
    * Finds a specific resource by its type and ID.
    *
-   * @template T - The type of the resource (defaults to SteveGetResponse)
-   * @param resourceType - The type of the resource to find (use **{@link K8S}** constant). See also {@link ResourceType}.
+   * @template T - Your specific resource type. Rancher will supplement the response with additional properties and methods
+   * @template I - An override for the response type. By default this uses T and supplements the response, or by supplying a value ignores T
+   * @param resourceType - The type of the resource to find (examples in **{@link K8S}**). See also {@link ResourceType}.
    * @param resourceId - The unique identifier of the resource to find. If the resource is namespaced, this should be in the format `namespace/name`.
    * @param options - Optional find arguments
    * @returns The found resource item or null if not found.
@@ -49,11 +73,11 @@ export class ResourcesApiClassImpl implements ResourcesApi {
    * const node = await resources.cluster.find(K8S.NODE, 'worker-1');
    * ```
    */
-  async find<T = SteveGetResponse>(
+  async find<T = Record<string, any>, I = ResourceInstance<T>>(
     resourceType: ResourceType,
     resourceId: string,
     options?: FindMethodOptions
-  ): Promise<T | null> {
+  ): Promise<I | null> {
     if (this.isNamespaced(resourceType) && !resourceId.includes('/')) {
       this.surfaceError(`Resource "${ resourceType }" is namespaced. The resourceId must be in "namespace/name" format, but received "${ resourceId }"`);
     }
@@ -65,8 +89,14 @@ export class ResourcesApiClassImpl implements ResourcesApi {
         opt:  options || {}
       });
 
-      return (resource as T) ?? null;
+      return resource as I;
     } catch (e: unknown) {
+      if ((e as any)?.status === 404) {
+        this.surfaceWarning(`Failed to find resource ${ resourceType }/${ resourceId }: ${ (e as Error).message }`, e);
+
+        return null;
+      }
+
       this.surfaceError(`Failed to find resource ${ resourceType }/${ resourceId }: ${ (e as Error).message }`, e);
     }
   }
@@ -74,18 +104,40 @@ export class ResourcesApiClassImpl implements ResourcesApi {
   /**
    * Finds resources using pagination mode with server-side filtering, sorting, and pagination.
    *
+   * The response is not cached
+   *
+   * Requires `ui-sql-cache` to be enabled.
+   *
+   * @template T - Your specific resource type. Rancher will supplement the response with additional properties and methods
+   * @template I - An override for the response type. By default this uses T and supplements the response, or by supplying a value ignores T
+   * @param resourceType - The type of the resources to find (examples in **{@link K8S}**). See also {@link ResourceType}.
+   * @param options - Pagination options with server-side filtering and sorting via the Steve API's pagination cache. See {@link FindFilteredPageOptions}.
+   * @returns Response containing resource items
+   * @throws Error if pagination mode is requested but `ui-sql-cache` is not enabled.
+   */
+  findFiltered<T = Record<string, any>, I = ActionFindPageTransientResponse<ResourceInstance<T>>>(
+    resourceType: ResourceType,
+    options: FindFilteredPageOptionsTransient
+  ): Promise<I>;
+
+  /**
+   * Finds resources using pagination mode with server-side filtering, sorting, and pagination.
+   *
+   * The response is cached.
+   *
    * Requires `ui-sql-cache` to be enabled.
    *
-   * @template T - The type of the resources (defaults to SteveListResponse)
-   * @param resourceType - The type of the resources to find
-   * @param options - Pagination options with server-side filtering and sorting
-   * @returns Response containing resource items (may be transient if requested, otherwise cached array)
-   * @throws If pagination mode is requested but `ui-sql-cache` is not enabled
+   * @template T - Your specific resource type. Rancher will supplement the response with additional properties and methods
+   * @template I - An override for the response type. By default this uses T and supplements the response, or by supplying a value ignores T
+   * @param resourceType - The type of the resources to find (examples in **{@link K8S}**). See also {@link ResourceType}.
+   * @param options - Pagination options with server-side filtering and sorting via the Steve API's pagination cache. See {@link FindFilteredPageOptions}.
+   * @returns Response containing resource items
+   * @throws Error if pagination mode is requested but `ui-sql-cache` is not enabled.
    */
-  findFiltered<T = SteveListResponse>(
+  findFiltered<T = Record<string, any>, I = ResourceInstance<T>>(
     resourceType: ResourceType,
     options: FindFilteredPageOptions
-  ): Promise<FindFilteredPageResponse<T>>;
+  ): Promise<I[]>;
 
   /**
    * Finds resources using label selector matching.
@@ -94,23 +146,25 @@ export class ResourcesApiClassImpl implements ResourcesApi {
    * - If `ui-sql-cache` is enabled: uses server-side pagination
    * - Otherwise: uses native Kubernetes API pagination
    *
-   * @template T - The type of the resources (defaults to SteveListResponse)
-   * @param resourceType - The type of the resources to find
-   * @param options - Label selector options for filtering
-   * @returns Response containing resource items (may be transient if requested, otherwise cached array)
+   * @template T - Your specific resource type. Rancher will supplement the response with additional properties and methods
+   * @template I - An override for the response type. By default this uses T and supplements the response, or by supplying a value ignores T
+   * @param resourceType - The type of the resources to find (examples in **{@link K8S}**). See also {@link ResourceType}.
+   * @param options - Label selector options for filtering. See {@link FindFilteredLabelSelectorOptions}.
+   * @returns Response containing resource items.
+   *
    */
-  findFiltered<T = SteveListResponse>(
+  findFiltered<T = Record<string, any>, I = FindFilteredLabelSelectorResponse<ResourceInstance<T>>>(
     resourceType: ResourceType,
     options: FindFilteredLabelSelectorOptions
-  ): Promise<FindFilteredLabelSelectorResponse<T>>;
+  ): Promise<I>;
 
   /**
    * @internal Implementation - use one of the overloads above
    */
-  async findFiltered<T = SteveListResponse>(
+  async findFiltered<T = Record<string, any>, I = ResourceInstance<T>>(
     resourceType: ResourceType,
-    options: FindFilteredPageOptions | FindFilteredLabelSelectorOptions
-  ): Promise<FindFilteredPageResponse<T> | FindFilteredLabelSelectorResponse<T>> {
+    options: FindFilteredPageOptions | FindFilteredPageOptionsTransient | FindFilteredLabelSelectorOptions
+  ): Promise<I[] | ResourceInstance<T>[] | ActionFindPageTransientResponse<ResourceInstance<T>>> {
     try {
       if ('pagination' in options) { // pagination mode
         const canPaginate = this.store.getters[`${ this.storeType }/paginationEnabled`]?.(resourceType);
@@ -125,7 +179,11 @@ export class ResourcesApiClassImpl implements ResourcesApi {
           opt:  safeOption
         });
 
-        return response as FindFilteredPageResponse<T>;
+        if (options.transient) {
+          return response as ResourceInstance<T>[];
+        }
+
+        return response as FindFilteredPageResponse<ResourceInstance<T>>;
       } else if ('labelSelector' in options) { // label selector mode
         const safeOption = options as FindFilteredLabelSelectorOptions;
         const { labelSelector, namespaced, ...rest } = safeOption;
@@ -138,7 +196,7 @@ export class ResourcesApiClassImpl implements ResourcesApi {
           opt: rest
         });
 
-        return resources as FindFilteredLabelSelectorResponse<T>;
+        return resources as FindFilteredLabelSelectorResponse<ResourceInstance<T>>;
       } else {
         return this.surfaceError('findFiltered request was made with unknown options');
       }
@@ -151,37 +209,168 @@ export class ResourcesApiClassImpl implements ResourcesApi {
    * Fetches all resources of a specific type with advanced options.
    * This method provides additional capabilities like incremental loading and namespace filtering.
    *
-   * @template T - The type of the resources (defaults to SteveListResponse)
-   * @param resourceType - The type of the resources to find (use **{@link K8S}** constant). See also {@link ResourceType}.
+   * @template T - Your specific resource type. Rancher will supplement the response with additional properties and methods
+   * @template I - An override for the response type. By default this uses T and supplements the response, or by supplying a value ignores T
+   * @param resourceType - The type of the resources to find (examples in **{@link K8S}**). See also {@link ResourceType}.
    * @param options - Optional advanced fetch options (incremental loading, namespace filtering, etc.)
    * @returns An array of resource items or an empty array if none are found.
+   */
+  async findAll<T = Record<string, any>, I = ResourceInstance<T>>(
+    resourceType: ResourceType,
+    options?: FindAllMethodOptions
+  ): Promise<I[]> {
+    try {
+      const resources = await this.store.dispatch(`${ this.storeType }/findAll`, {
+        type: resourceType,
+        opt:  options || {}
+      });
+
+      return (resources || []) as I[];
+    } catch (e: unknown) {
+      this.surfaceError(`Failed to find all resources ${ resourceType }: ${ (e as Error).message }`, e);
+    }
+  }
+
+  /**
+   * Creates a new resource.
+   *
+   * The `data` object must include a `type` property identifying the resource type.
+   * This is a raw HTTP operation — it does not check permissions or update the store cache.
+   *
+   * @template T - Your specific resource type. Rancher will supplement the response with additional properties and methods
+   * @template I - An override for the response type. By default this uses T and supplements the response, or by supplying a value ignores T
+   * @param data - The resource data to create. Must include a `type` property (examples in **{@link K8S}**). See also {@link CreateResourceData}.
+   * @returns The created resource instance.
+   */
+  async create<T = Record<string, any>, I = SteveResource<T>>(
+    data: CreateResourceData
+  ): Promise<I> {
+    try {
+      if (!data.type) {
+        return this.surfaceError('Resource data must include a "type" property');
+      }
+
+      const url = this.resourceUrl(data.type);
+
+      const res = await this.store.dispatch(`${ this.storeType }/request`, {
+        opt: {
+          url,
+          method:  'POST',
+          headers: { 'content-type': 'application/json' },
+          data,
+        }
+      });
+
+      return res as I;
+    } catch (e: unknown) {
+      this.surfaceError(`Failed to create resource of type "${ data.type }": ${ (e as Error).message }`, e);
+    }
+  }
+
+  /**
+   * Applies a partial update to a resource using HTTP PATCH (merge-patch).
+   *
+   * Only the fields provided in `data` are sent to the server.
+   * This is a raw HTTP operation — it does not check permissions or update the store cache.
+   *
+   * @template T - Your specific resource type. Rancher will supplement the response with additional properties and methods
+   * @template I - An override for the response type. By default this uses T and supplements the response, or by supplying a value ignores T
+   * @param resourceType - The type of the resource (examples in **{@link K8S}**). See also {@link ResourceType}.
+   * @param resourceId - The unique identifier. If namespaced, use `namespace/name` format.
+   * @param data - An object containing only the fields to update.
+   * @returns The server response.
+   */
+  async update<T = Record<string, any>, I = SteveResource<T>>(
+    resourceType: ResourceType,
+    resourceId: string,
+    data: Record<string, any>
+  ): Promise<I> {
+    try {
+      const url = this.resourceUrl(resourceType, resourceId);
+      const res = await this.store.dispatch(`${ this.storeType }/request`, {
+        opt: {
+          url,
+          method:  'patch',
+          headers: { 'content-type': 'application/strategic-merge-patch+json' },
+          data,
+        }
+      });
+
+      return res as I;
+    } catch (e: unknown) {
+      this.surfaceError(`Failed to update resource ${ resourceType }/${ resourceId }: ${ (e as Error).message }`, e);
+    }
+  }
+
+  /**
+   * Performs a full replacement update of a resource using HTTP PUT.
+   *
+   * Runs `cleanForSave` on the data before sending.
+   * This is a raw HTTP operation — it does not check permissions or update the store cache.
+   *
+   * @template T - Your specific resource type. Rancher will supplement the response with additional properties and methods
+   * @template I - An override for the response type. By default this uses T and supplements the response, or by supplying a value ignores T
+   * @param resourceType - The type of the resource (examples in **{@link K8S}**). See also {@link ResourceType}.
+   * @param resourceId - The unique identifier. If namespaced, use `namespace/name` format.
+   * @param data - The complete resource data to send as the replacement.
+   * @returns The server response.
+   */
+  async replace<T = Record<string, any>, I = SteveResource<T>>(
+    resourceType: ResourceType,
+    resourceId: string,
+    data: Record<string, any>
+  ): Promise<I> {
+    try {
+      const url = this.resourceUrl(resourceType, resourceId);
+      const model = await this.store.dispatch(`${ this.storeType }/create`, data);
+      const cleanData = model.cleanForSave({ ...data });
+      const res = await this.store.dispatch(`${ this.storeType }/request`, {
+        opt: {
+          url,
+          method:  'put',
+          headers: { 'content-type': 'application/json' },
+          data:    cleanData,
+        }
+      });
+
+      return res as I;
+    } catch (e: unknown) {
+      this.surfaceError(`Failed to update resource ${ resourceType }/${ resourceId }: ${ (e as Error).message }`, e);
+    }
+  }
+
+  /**
+   * Deletes a resource by type and ID using HTTP DELETE.
+   *
+   * This is a raw HTTP operation — it does not check permissions or update the store cache.
+   *
+   * @param resourceType - The type of the resource (examples in **{@link K8S}**). See also {@link ResourceType}.
+   * @param resourceId - The unique identifier. If namespaced, use `namespace/name` format.
    *
    * @example
    * ```ts
    * import { useResources, K8S } from '@shell/apis';
-   * import type { Pod } from '@shell/types/resources';
    *
    * const resources = useResources();
    *
-   * // Fetch all pods in specific namespaces
-   * const pods = await resources.cluster.findAll<Pod>(K8S.POD, {
-   *   namespaced: ['default', 'kube-system']
-   * });
+   * await resources.cluster.delete(K8S.CONFIG_MAP, 'default/my-config');
    * ```
    */
-  async findAll<T = SteveListResponse>(
+  async delete(
     resourceType: ResourceType,
-    options?: FindAllMethodOptions
-  ): Promise<T[]> {
+    resourceId: string
+  ): Promise<void> {
     try {
-      const resources = await this.store.dispatch(`${ this.storeType }/findAll`, {
-        type: resourceType,
-        opt:  options || {}
-      });
+      const url = this.resourceUrl(resourceType, resourceId);
 
-      return resources as T[];
+      await this.store.dispatch(`${ this.storeType }/request`, {
+        opt: {
+          url,
+          method: 'delete',
+        }
+      });
     } catch (e: unknown) {
-      this.surfaceError(`Failed to find all resources ${ resourceType }: ${ (e as Error).message }`, e);
+      this.surfaceError(`Failed to delete resource ${ resourceType }/${ resourceId }: ${ (e as Error).message }`, e);
     }
   }
 }

package/assets/styles/global/_button.scss

@@ -8,7 +8,7 @@ $btn-sm-height: 30px;
 // -----------------------------------------------------------------------------
 .btn,
 button,
-[class^='btn-'] {
+[class^='btn-']:not(.btn-group) {
   align-items: center;
   display: inline-flex;
   text-align: center;

package/assets/translations/en-us.yaml

@@ -72,6 +72,7 @@ generic:
       warning: Warning
       error: Error
   ok: OK
+  or: or
   other: |-
     {count, plural,
     one  {other}
@@ -503,6 +504,7 @@ authConfig:
   allowedPrincipalIds:
     title: Authorized Users & Groups
   associatedWarning: 'The {provider} account that is used to enable the external provider will be granted permissions equal to the currently logged in Rancher user. See <a href="{docsBase}/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config#external-authentication-configuration-and-principal-users" target="_blank" rel="noopener noreferrer nofollow">External Authentication Configuration and Principal Users</a> to understand why.'
+  bannerEnableAuthProvider: "The \"Disable Local Authentication\" setting is enabled. Enabling an Authentication Provider will prevent users from logging in with local credentials. In the event of a Provider failure no user will be able to log in. Ensure you have continued API or CLI access to Rancher to disable the feature and regain access."
   githubapp:
     clientId:
       label: Client ID
@@ -1007,6 +1009,7 @@ asyncButton:
     action: Snapshot Now
     waiting: Snapshot Initiated&hellip;
     success: Snapshot Creating
+    day2OpsNotEnabled: Day 2 Operations are not enabled for this cluster
   timing:
     action: Generate Response Times
     waiting: Generating&hellip;
@@ -1138,9 +1141,15 @@ catalog:
       label: Container Registry
       tooltip: Container images are pulled from the Cluster Container Registry or, failing that, the System Container Registry Setting. To change this default behavior enter or update the registry here
       custom:
-        checkBoxLabel: Container Registry for Rancher System Container Images
+        checkBoxLabel: Override the Default Container Registry
         inputLabel: Container Registry
         placeholder: Registry domain and ports, ex. registry.io:5000
+      pullSecret:
+        skipOption: Do not use image pull secrets
+        defaultLabel: 'Use default pull secret ({name})'
+        defaultLabelGeneric: Use default pull secrets
+        existingValuesBanner: '{secrets} are configured as image pull secrets in the chart values. To modify them, edit the values YAML directly.'
+        defaultSecretsBanner: '{secrets} are configured as default pull secrets. Select or create an image pull secret here to override the default.'
     header:
       charts: Charts
     info:
@@ -1358,6 +1367,8 @@ catalog:
         generatedNewImagePullSecret: "A new Image Pull Secret <b>{ imagePullSecretName }</b> will be generated"
         generatedImagePullSecretBannerFromPreviousAuth: "A new Image Pull Secret <b>{ imagePullSecretName }</b> will be generated from the Repository secret <b>{ repoAuthenticationName }</b>."
         usePreviouslyGeneratedImagePullSecretBanner: "Image Pull Secret <b>{ imagePullSecretName }</b> was already created previously from the Repository secret <b>{ repoAuthenticationName }</b> and will be used."
+        oldMonitoringChartWarning: "From v2.15.0 this chart is deprecated, instead please use the new Rancher Monitoring Dashboard chart."
+        newMonitoringChartWarning: "Before installing the new Rancher Monitoring Dashboard chart please make sure any applications using the old Rancher Monitoring Chart have been uninstalled and dependencies such as Prometheus have been installed."
       clusterTplVersion:
         label: Version
         subtext: Select a version of the template
@@ -2164,7 +2175,8 @@ cluster:
         label: Enable IPv6
       httpProtocolIpv6: 
         label: Enable IPv6 endpoint for instance metadata service
-      ipv6ValidationWarning: When one pool uses an IPv6 or dual-stack subnet/vpc, all pools must use an IPv6 or dual-stack subnet/vpc.
+      dualStackValidationWarning: When one pool enables dual-stack subnet/vpc, all pools must use the same networking configuration.
+      ipv6ValidationWarning: When one pool enables IPv6 subnet/vpc, all pools must use the same networking configuration.
     pnap:
       serverLocation:
         label: Location
@@ -2442,7 +2454,7 @@ cluster:
     aws: Amazon
     azure: Azure
     azureaks: Azure AKS
-    aks: Azure AKS
+    aks: AKS
     azurekubernetesservice: Azure AKS (Unsupported Kev1)
     baiducloudcontainerengine: Baidu CCE
     baidu: Baidu CCE
@@ -2451,13 +2463,13 @@ cluster:
     custom: Custom
     digitalocean: DigitalOcean
     docker: Docker
-    eks: Amazon EKS
+    eks: EKS
     exoscale: Exoscale
     sks: Exoscale SKS
     gcp: Google
     google: Google GCE
     googlegke: Google GKE
-    gke: Google GKE
+    gke: GKE
     googlekubernetesengine: Google GKE (Unsupported Kev1)
     harvester: Harvester
     huaweicce: Huawei CCE
@@ -2680,6 +2692,7 @@ cluster:
         other {A snapshot has been requested for {count} clusters}
       }
     groupLabel: Location
+    predatesImportTooltip: The restore action is not currently supported for this snapshot as it predates the import into Rancher.
     failed: "Snapshot from {time} failed"
     rke1:
       local: local
@@ -2744,6 +2757,7 @@ cluster:
     upgrade: Upgrade Strategy
     registration: Registration
     nodePools: Node Pools
+    operations: Operations
   rotateCertificates:
     label: Rotate Certificates
     modalTitle: Rotate Cluster Certificates
@@ -2984,10 +2998,10 @@ fleet:
     title: Continuous Delivery Settings
     info: Rancher will reboot Fleet agent and controller on settings change.
     apply: Apply changes
-    noPermissions: You have no permissions to modify Fleet Settings
+    noPermissions: You have no permissions to modify Continuous Delivery Settings
     parseError: 'Cannot parse values from "{ path }" in "{ id }" ConfigMap'
     fields:
-      ariaLabel: Fleet {name} setting
+      ariaLabel: Continuous Delivery {name} setting
     agentTLSMode:
       label: TLS Mode
       description: "Determines whether the agent should trust CA bundles from the operating system's trust store when connecting to a management cluster."
@@ -3064,13 +3078,13 @@ fleet:
       description: 'Agent deployment settings.'
     replicas:
       label: Replicas
-      description: 'Number of replicas of Fleet pods.'
+      description: 'Number of replicas of pods.'
     annotations:
       label: Extra Annotations
-      description: 'Extra annotations passed to the Fleet pods.'
+      description: 'Extra annotations passed to the pods.'
     developer:
       label: Developer
-      description: 'Enable debug info from Fleet.'
+      description: 'Enable debug info.'
 
   tableHeaders:
     applicationType: Type
@@ -3081,7 +3095,7 @@ fleet:
   dashboard:
     pageTitle: Continuous Delivery Dashboard
     menuLabel: Dashboard
-    welcome: Welcome to Fleet Continuous Delivery
+    welcome: Welcome to Continuous Delivery
     gitOpsScale: GitOps at scale.
     learnMore: Learn More.
     learnMoreLink: https://fleet.rancher.io
@@ -3204,7 +3218,7 @@ fleet:
     groupBy: Group By Type
     subTypes:
       fleet.cattle.io.gitrepo:
-        description: GitRepo describes a git repository that is watched by Fleet. The resource contains the necessary information to deploy the repo, or parts of it, to target clusters.
+        description: GitRepo describes a git repository that is watched. The resource contains the necessary information to deploy the repo, or parts of it, to target clusters.
       fleet.cattle.io.helmop:
         description: HelmOp is a simplified way of creating bundles by directly pointing to a Helm repository or to an OCI registry, without needing to set up a git repository.
       suse-application-collection:
@@ -6025,6 +6039,13 @@ promptRestore:
   fromS3: Restore from S3
   label: Snapshot
   placeholder: Select a snapshot to restore
+  error:
+    unableToResolveTargetCluster: Unable to resolve target cluster for snapshot restore
+  restoreMode:
+    label: Restore Type
+    onlyEtcd: Only etcd
+    kubernetesVersionAndEtcd: Kubernetes version and etcd
+    clusterConfigKubernetesVersionAndEtcd: Cluster config, Kubernetes version and etcd
   notification:
     title: Restore Snapshot
     message: Restoring snapshot { selectedSnapshot } has started...
@@ -6048,7 +6069,9 @@ promptRotateEncryptionKey:
   title: Rotate Encryption Keys
   description: The last backup {name} was performed on {date}
   warning: Before proceeding, ensure a successful ETCD backup of the cluster has been completed.
-  error: No backup found
+  error:
+    noBackup: No backup found
+    unableToResolveTargetCluster: Unable to resolve target cluster for encryption key rotation
 
 rancherAlertingDrivers:
   msTeams: Enable Microsoft Teams
@@ -6333,6 +6356,8 @@ resourceYaml:
 
 secret:
   authentication: Authentication
+  githubApp:
+    label: GitHub App
   certificate:
     certificate: Certificate
     certificates: Certificates
@@ -6469,14 +6494,19 @@ selectOrCreateAuthSecret:
     passwordPersonalAccessToken: Password/Personal Access Token
   rke:
     info: "An RKE Auth Config secret contains the username and password concatenated and base64 encoded into the secret's 'auth' key"
+  githubApp:
+    appId: GitHub App ID
+    installationId: GitHub App Installation ID
+    privateKey: GitHub App Private Key
   namespaceGroup: "Namespace: {name}"
   chooseExisting: "Choose an existing secret:"
   createSsh: Create an SSH Key Secret
   createBasic: Create an HTTP Basic Auth Secret
   createS3: Create an S3-Compatible Auth Secret
   createRKE: Create an RKE Auth Config Secret
+  createGithubApp: Create a GitHub App Auth Secret
   createImagePullSecretBasedOnAuth: Create an Image Pull Secret based on Authentication Secret
-  createImagePullSecret: Create a new Image Pull Secret with new Username/Password
+  createImagePullSecret: Create an Image Pull Secret with a Username and Password
 
 serviceAccount:
   automount: Automount Service Account Token
@@ -7363,6 +7393,7 @@ validation:
   betweenValues: '"{key}" must be between {min} and {max}'
   noSchema: No schema found to validate
   noType: No type to validate
+  createResourceFailed: 'Failed to create resource: insufficient permissions or resource type not found'
   number:
     requiredInt: '"{key}" must be integer'
     isPositive: '"{key}" must be positive'
@@ -8966,6 +8997,7 @@ advancedSettings:
     'ingress-ip-domain': 'Wildcard DNS domain to use for automatically generated Ingress hostnames. <ingress-name>.<namespace-name>.<ip address of ingress controller> will be added to the domain.'
     'server-url': 'Default {appName} install url. Must be HTTPS. All nodes in your cluster must be able to reach this.'
     'system-default-registry': 'Private registry to be used for all Rancher System Container Images. If no value is specified, the default registry for the container runtime is used. For Docker and containerd, the default is `docker.io`.'
+    'system-default-registry-pull-secrets': 'List of image pull secrets to authenticate into registry from which Rancher System Container Images are pulled. By default, these secrets will be copied into each Rancher chart namespace. Secrets must be in the `cattle-system` namespace. The first valid secret listed here will be used.'
     'ui-dashboard-index': 'HTML index location for the {appName} UI.'
     'ui-offline-preferred': 'Controls whether UI assets are served locally by the server container or from the remote URL defined in the ui-dashboard-index setting. The `Dynamic` option will use local assets in production builds of {appName}.'
     'ui-pl': 'Private-Label company name.'
@@ -8988,6 +9020,7 @@ advancedSettings:
     'k3s-based-upgrader-uninstall-concurrency': Defines the maximum number of clusters in which Rancher can concurrently uninstall the legacy `rancher-k3s-upgrader` or `rancher-rke2-upgrader` app from imported or node-driver K3s or RKE2 clusters.
     'system-agent-upgrader-install-concurrency': Defines the maximum number of clusters in which Rancher can concurrently install the resources required for upgrading system-agent.
     'imported-cluster-version-management': Enables version management for imported RKE2/K3s clusters, and the local cluster if it is an RKE2/K3s cluster. The per-cluster version management setting overrides this global setting at the cluster level. For existing clusters where the cluster-level version management is set to 'system-default', changing this flag will trigger a redeployment of the cluster agent during the next reconciliation (by default every 5 minutes, or as soon as the cluster is edited, whichever comes first).
+    'imported-cluster-day2-ops-enabled': Controls whether newly imported RKE2/K3s clusters will have day 2 operations (etcd snapshots, restores, encryption key rotations) enabled by default. This does not affect previously imported clusters.
   warnings:
     'agent-tls-mode': 'Changing this setting will cause all agents to be redeployed.'
   editHelp:
@@ -9015,6 +9048,8 @@ advancedSettings:
     header: Cluster Provisioning
 
 featureFlags:
+  description:
+    'hide-local-auth-provider': Activating this feature and enabling an Authentication Provider will prevent users from logging in with local credentials. In the event of a Provider failure no user will be able to log in. Ensure you have continued API or CLI access to Rancher to disable the feature and regain access
   label: Feature Flags
   title: "Are you sure?"
   warning: |-