paralus/dashboard

Dashboard used with Paralus zero-trust solution to manage importing clusters, users, groups, roles and role association to multiple kubernetes clusters.

Paralus

Paralus is a free, open source tool that enables controlled, audited access to Kubernetes infrastructure for your users, user groups, and services. Ships as a GUI, API, and CLI. We are a CNCF Sandbox project

Paralus can be easily integrated with your pre-existing RBAC configuration and your SSO providers, or Identity Providers (IdP) that support OIDC (OpenID Connect). Through just-in-time service account creation and fine-grained user credential management, Paralus provides teams with an adaptable system for guaranteeing secure access to resources when necessary, along with the ability to rapidly identify and respond to threats through dynamic permission revocation and real time audit logs.

Features

• Creation of custom roles, users, and groups.
• Dynamic and immediate changing and revoking of permissions.
• Ability to control access via pre-configured roles across clusters, namespaces, projects, and more.
• Seamless integration with Identity Providers (IdPs) allowing the use of external authentication engines for users and group definitions, such as GitHub, Google, Azure AD, Okta, and others.
• Automatic logging of all user actions performed for audit and compliance purposes.
• Interact with Paralus either with a modern web GUI (default), a CLI tool called pctl, or Paralus API.

Getting Started

Installing and setting up Paralus takes less time than it takes to brew a (good) cup of coffee! You'll find the instructions here:

• Docs
• Installation

🤗 Community & Support

• Check out the Paralus website for the complete documentation and helpful links.
• Join our Slack workspace to get help and to discuss features.
• Tweet @paralus_ on Twitter.
• Create GitHub Issues to report bugs or request features.
• Join our Paralus Community Meeting where we share the latest project news, demos, answer questions, and triage issues. Add to your calendar by importing ics file.
  • 🗓️ 2nd and 4th Tuesday
  • ⏰ 20:30 IST | 10:00 EST | 07:00 PST
  • 🔗 Zoom
  • 🗒️ Meeting minutes

Participation in Paralus project is governed by the CNCF Code of Conduct.

Contributing

We 💖 our contributors! Have a look at our contributor guidelines to get started.

If you’re looking to add a new feature or functionality, create a new Issue.

You're also very welcome to look at the existing issues. If there’s something there that you’d like to work on help improving, leave a quick comment and we'll go from there!

Authors

This project is maintained & supported by Rafay. Meet the maintainers of Paralus.

dashboard's Issues

Copy password reset url on click of copy icon

Briefly describe the feature

• Ability for a user to click on copy icon for password reset url

What problem does this feature solve? Please link any relevant documentation or Issues

• sometimes clicked on the url from an active logged in session causes issues. Usability Improvement.

(optional) What is your current workaround?

• User has to select the entire url and copy it.

User should not be able to edit predefined roles ( including org admins )

Creation date not shown for projects

OSS	Non OSS

Remove locations

Cross platform / arch docker image build - support for linux/arm64

Briefly describe the feature

• Need for a cross arch / platform docker image to be built

What problem does this feature solve? Please link any relevant documentation or Issues

• Currently it builds only linux/amd64 based images. Solves compatibility issues.

Incorrent Password Recovery Link

The current password recovery link that is generated has an extra self-service in the url due to which the page throws a HTTP 404 error.

Current:
Org Admin signup URL: http://console.chart-example.com/self-service/self-service/recovery?flow=

Expected
Org Admin signup URL: http://console.chart-example.com/self-service/recovery?flow=

Reset password option failing with blank screen

Namespace rendering issue in edit project

• All chosen roles are not shown selected in the edit project in user routes.
• all namspace names are not shown properly in the edit project page in user routes.
• "ALL PROJECTS" entry is removed in edit user section when clicked on profile section and gets back when we come from GROUPS tab.

Invalid date displayed on cluster page

Expected vs actual behavior

• Expected: Currently after a cluster is imported to Paralus, it shows "Last Check in invalid date" beside reachability check.
• Actual: It should display the date when the system last checked the health of the imported cluster.

Steps to reproduce the bug

1. Import any cluster
2. Observe the date line on the page

Output:

• I've described the bug, included steps to reproduce it, and included my environment setup with all customizations.
• I'm using the latest version of the project.

User ends up on a blank screen after first time login

Expected vs actual behavior

• As a user, I should be able to view the projects screen with the projects that I am entitled to view.

Steps to reproduce the bug

1. Install Paralus and setup admin user credentials
2. Open a new incognito window or a different browser from the one you are currently using.
3. Login to paralus using the user credentials

Are you using the latest version of the project?

You can check your version by running helm ls|grep '^<deployment-name>' or using pctl, pctl version, and provide the output.

• Yes, v0.1.0

What is your environment setup? Please tell us your cloud provider, operating system, and include the output of kubectl version --output=yaml and helm version. Any other information that you have, eg. logs and custom values, is highly appreciated!

• Kind cluster, but not limited to. Should be reproducible irrespective of the underlying infrastructure.

(optional) If you have ideas on why the bug happens or how it can be solved, please provide it here

• Looks like the initialization of organization and partner information happens after initial login screen the first time ever.

• I've described the bug, included steps to reproduce it, and included my environment setup with all customizations.
• I'm using the latest version of the project.

Choosing a project in dropdown redirects to homepage

The Project selection drop down on the cluster page redirects the user to the home page instead of redirecting to the selected projected page.

Steps to Reproduce:

• Create a new project
• Create a new cluster
• Click on Cluster and navigate to the cluster page
• From the drop down - next to the logo - select default

Expected Behavior:
The user should be redirected to default project page

Actual Behavior:
The user is redirected to homepage

Roles are not consistent with the roles that we have available

Also, seems like selecting the ORGANIZATION READ ONLY select both ADMIN and ADMIN_READ_ONLY.

Add Paralus Logo On Login Screen

The feature request is to add the Paralus logo on the login screen above the username and password fields.

This logo can be configurable during installation via the yaml configuration file so the user can replace the logo with theirs instead of using the Paralus's default logo (or remove it alltogether)

It will not only make the login page look good, but also professional.

Audit log screen issues

• Pagination is broken
• Project filter missing
• Restrict project admin audit logs to specific project
• Group name not shown (backend issue)
• Range filters seems to be misbehaving (seems to be working)
• Project admin not able to access project audit logs (seems to be working)
• Browser refresh redirects to login page (tracking in #28)

Pass down org and partner in header

Related to https://github.com/RafayLabs/rcloud-base/issues/89

New IdP provider page enhancements

1. Support adding multiple inputs for scopes, each input is an element of scopes list. Alternatively support this by comma separated elements in single input box. Currently value of scopes input is passed in first element of scopes list to the back-end.
   
2. Take optional Auth URL and Token URL in IDP configuration form.
3. Support updating client secret.
4. [BUG] Updating any field in IDP CONFIGURATION tag, deletes mapper link.
5. Copy button for callback url, issuer url is not working

Revoke user kubeconfig option is failing

Go to users screen, from menu option for a particular user .. select revoke kubeconfig which fails.

View Cluster details by clicking on cluser name

When the user clicks on the cluster name from clusters page (shown below), they should be taken to cluster configuration page. The default product has this behavior that I feel we must preserve.

Image 1: Cluster Page

Image 2: Cluster Configuration Page

Cluster Tabular List should be default option in show clusters screen

Briefly describe the feature

• By default, cluster tabular list should be the default option
• Remove location and add cluster created on column
• Add actions as Icons

What problem does this feature solve? Please link any relevant documentation or Issues

• Usability

Forgot password (initialize a recovery flow in kratos)

As of now, if a user forgets the password, the reset workflow is for an admin to reset and fetch recovery link via the backend. Kratos has an option to send a a recovery link via email if they have an SMTP server specified. We could consider wiring it up.

Support for namespaces

• view namespace roles in role mapping screens
• changes to user role mapping screen
• edit user project assoc - if namespaced scope role assigned, namespaces should be displayed
• edit user project assoc - if namespaced scope role assigned, namespaces should be displayed in chips (project role matrix)
• edit user project assoc - add and remove namespace chip, when empty validation should be done
• changes to group role mapping screen
• edit group project assoc - if namespaced scope role assigned, namespaces should be displayed
• edit group project assoc - if namespaced scope role assigned, namespaces should be displayed in chips (project role matrix)
• edit group project assoc - add and remove namespace chip, when empty validation should be done
• changes to custom role creation for namespaced roles
• verify kubectl based on namespaced roles

Unable to update idp role

Most probably because we are not handling the fact that roles are a list when we get it back.

Project manage membership: Should not be able to associate org inbuilt role to users and groups

Expected vs actual behavior

• Expected: Admins should be able to associate user to project / namespace scoped roles from Project manage membership -> Assign user to Project
• Actual: Choosen user selection gets cleared and also nothing happens on clicking Save & Exit when an organization scoped role is chosen

Steps to reproduce the bug

1. Login as Admin to Paralus Dashboard
2. Navigate to Project Manage Membership -> Assign User To Project
3. Choose a user and select Organization admin or Organization read only role
4. Observe the selected user dropdown and also try clicking Save & Exit

Are you using the latest version of the project?

• Yes, v.0.1.0

What is your environment setup? Please tell us your cloud provider, operating system, and include the output of kubectl version --output=yaml and helm version. Any other information that you have, eg. logs and custom values, is highly appreciated!

• Kind

(optional) If you have ideas on why the bug happens or how it can be solved, please provide it here

• NA

• I've described the bug, included steps to reproduce it, and included my environment setup with all customizations.

• I'm using the latest version of the project.

Provide some info when user does not have access to any resource

As of now, we just get a blank screen if the user does not have access to any resource. Would be better to have some kind of message indicating that the user does not have any access.

Handle user facing errors from Kratos

Background:
When a user-facing error occurs for example during Self Service User Login, Ory Kratos will store error message and context and redirect the User's Browser to the Error UI URL set by the selfservice.flows.error.ui_url configuration or SELFSERVICE_FLOWS_ERROR_UI_URL environment variable.

Actual result:
Since we do not have error UI screen, any error occurred by Kratos in login flow will redirect user to ory.sh error page.

Expected result:
Design a error ui page to display error message from Kratos.

Additional information:
Check error message details here: https://www.ory.sh/docs/kratos/self-service/flows/user-facing-errors
Once UI is ready, set selfservice.flows.error.ui_url in back-end.

Error popup on password reset page appears more than once

When the user first time access the reset password url page and gives a simple password, the page shows the error in a popup. However clicking on the popup doesn't close it. It reappears, seems like it is generating multiple popups. For each click of set password there are 2-3 error popups.

Enhancement/Suggestion:
Also, we could probably try to show it on the UI in <div> or something so that even if someone has popup blocker enabled, they know the error.

Users screen showing same users for local and idp tab

You can pass in a extra query parameter type=password or type=oidc to filter users.

Clicking on Go To Project first time, doesn't work

Issue
Clicking on Go To Project button after creating a new project, doesn't take the user to the project's page.

Steps to Reproduce

1. Create a New Project
2. Click on Go To Project on the project's card

Expected Behavior
The user should be redirected to the project's page.

Actual Behavior
The user is on the page, and errors are observed in the console logs.

Workaround
Refresh the page

UI Cleanups

Expected vs actual behavior

• Control plane health status not updating and needs to be removed
• Cluster detail page not showing cluster name in breadcrumbs
• Remove last check in and cluster status from cluster detail page

Steps to reproduce the bug

1. View the clusters page and cluster detail page

Are you using the latest version of the project?

You can check your version by running helm ls|grep '^<deployment-name>' or using pctl, pctl version, and provide the output.

• Yes, 0.1.3

• I've described the bug, included steps to reproduce it, and included my environment setup with all customizations.
• I'm using the latest version of the project.

Add Docker-compose for development setup

Add Docker compose file that setup rcloud-base and other dependencies required for rcloud-console-ui. Docker-compose is easy way to setup dependencies and start UI development without hiccup of cloning rcloud-base and starting it.
cc @niravparikh05

Group selection in new user creation is broken

When creating a new user, if we click on select all for groups, the json data sent to user create is not correct. There is a top level groups array in this case which should have been inside spec.

Having role as project admin causes UI to continuous poll for projects

The requests seems to have stopped when I moved away from the tab

Pagination issues

• Projects page
• Clusters inside projects (no pagination is happening, always shows all of them)

Refactor per branding name

• change the repo name
• changes to all files with Rafay, any components
• logo to be changed
• CI / CD needs to be changed
• readme's, contributing docs, issue, features templates
• governance related docs - to be checked

Completely empty page when user with role `PROJECT_ADMIN` clicks on a project

Users cannot rename a project

If there's a typo while creating a project, the user doesn't have an option to edit/rename the project.

The user should be allowed to rename a project.

Open in new page for prompt does not work

User login

Top level issue for tracking major pending items

• Login
• Logout
• #40
• Account recovery
• Permission mapping for screens
• User token refresh (when the user is continuously using the page)

Make sure project and cluster names are unique

• As of now we are able to create multiple projects with same name (backend should return error if duplicate)
• If we try to create multiple clusters with same name, UI goes blank

Project Manage Membership: Unable to associate inbuilt namespaced roles to users and groups

Expected vs actual behavior

• Expected: Admin should be able to associate namespaced roles to users
• Actual: Inbuilt namespaced roles are disabled, thus admins cannot choose them while associating roles

Steps to reproduce the bug

1. Login to Paralus dashboard as Admin user
2. Navigate to Project Manage Membership -> Associate User to Projects
3. You can see that inbuilt namespaced roles are disabled by default

Are you using the latest version of the project?

• Yes, v0.1.0

What is your environment setup? Please tell us your cloud provider, operating system, and include the output of kubectl version --output=yaml and helm version. Any other information that you have, eg. logs and custom values, is highly appreciated!

• Kind

(optional) If you have ideas on why the bug happens or how it can be solved, please provide it here

• NA

• I've described the bug, included steps to reproduce it, and included my environment setup with all customizations.

• I'm using the latest version of the project.

set password screen shows password mismatch even though it is successful

Export Logs Doesn't Work

Issue
Under audit logs section, the Export Log feature doesn't work.

Steps to Reproduce:

1. Navigate to Audit Logs
2. Click on Export Button

Actual Output:
Nothing.

Expected Output:
The logs should be downloaded

Screenshot:
There's an uncaught exception that might be causing this error.

Groups shown as undefined for admin user with default groups

Unable to assign project admin as a role for group

Looks like it is sending the entire project struct instead of just the project name.

Request:

{"apiVersion":"system.k8smgmt.io/v3","kind":"Group","metadata":{"name":"newgroup","labels":{"organization":"exampleorg","partner":"example"},"organization":"exampleorg","partner":"example","modifiedAt":{"seconds":1651139117,"nanos":366311000}},"spec":{"users":["[email protected]"],"type":"SYSTEM","projectNamespaceRoles":[{"project":{"metadata":{"name":"default","description":"Default project ..","labels":{"organization":"94b83b48-00b3-48e0-9881-557d38dbdb39","partner":"eb76dbae-a04e-4d1a-b27a-892e95ff1301"},"organization":"94b83b48-00b3-48e0-9881-557d38dbdb39","partner":"eb76dbae-a04e-4d1a-b27a-892e95ff1301","id":"ff6bd208-6801-42b8-980a-7b3d8048ad93","modifiedAt":{"seconds":1651135547,"nanos":606921000}},"spec":{"default":true,"userRoles":[{"user":"[email protected]","role":"PROJECT_ADMIN"}]}},"role":"PROJECT_ADMIN","group":"newgroup"}]},"status":{"conditionStatus":2}}

Response:

{"code":3,"message":"json: cannot unmarshal \"{\\\"metadata\\\":{\\\"name\\\":\\\"default\\\",\\\"d...\" into Go struct field userv3.Groupuserv3.GroupSpec[]*userv3.ProjectNamespaceRoleuserv3.ProjectNamespaceRole.spec.projectNamespaceRoles.0.project of type string"}

View cluster audit logs action from clusters list screen

Briefly describe the feature

• View cluster audit logs for cluster from actions of cluster tabular list

What problem does this feature solve? Please link any relevant documentation or Issues

• Ease of access to cluster audit logs, usability.

Login does not redirect to dashboard after successful login

cli download - ability to get latest download urls from /auth/cli/download

Update readme with project details

As of now the project readme page is just simple create-react-app bootstrap page content which was created during the transition. Update them to reflect project info.

ui not adhering to user roles, entitlements ..

Group mapping issues for IDP users

• IDP groups and managed groups are not separate as of now
• Cannot assign a managed group from users screen for IDP users