provide the ability to disable features

crd-docs/cr/kiali.io_v1alpha1_kiali.yaml

@@ -352,6 +352,7 @@ spec:
       - "istio-ca-secret"
     clustering:
       enabled: true
+    disabled_features: []
     istio_injection_action: true
     istio_upgrade_action: false
     ui_defaults:

crd-docs/crd/kiali.io_kialis.yaml

@@ -958,6 +958,12 @@ spec:
                       enabled:
                         description: "Flag to enable/disable clustering and federation related features."
                         type: boolean
+                  disabled_features:
+                    description: "There may be some features that admins do not want to be accessible to users (even in 'view only' mode). In this case, this setting allows you to disable one or more of those features entirely."
+                    type: array
+                    items:
+                      type: string
+                      enum: ["logs-tab"]
                   istio_injection_action:
                     description: "Flag to enable/disable an Action to label a namespace for automatic Istio Sidecar injection."
                     type: boolean

molecule/config-values-test/converge.yml

@@ -24,6 +24,22 @@
       - kiali_pod_spec.containers[0].resources.requests.memory == "64Mi"
       - kiali_pod_spec.containers[0].resources.limits.memory == "1Gi"
 
+  - name: Get Kiali Role
+    vars:
+      instance_name: "{{ kiali.instance_name | default('kiali') }}"
+    k8s_info:
+      api_version: rbac.authorization.k8s.io/v1
+      kind: Role
+      namespace: "{{ kiali.install_namespace }}"
+      label_selectors:
+      - "app.kubernetes.io/instance={{ instance_name }}"
+    register: kiali_role_raw
+
+  - name: Make sure Kiali Role has access to pods/log
+    assert:
+      that:
+      - kiali_role_raw.resources[0].rules | to_yaml is search('pods/log')
+
   # This test will change some config settings to make sure things work like we expect.
   # We will add additional tasks and asserts in the future to test other config changes.
   # We load in the current kiali CR and then alter it with new config and deploy that new CR.
@@ -103,6 +119,10 @@
     set_fact:
       current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'deployment': {'configmap_annotations': {'aaa': 'bbb', 'camelCaseName': 'camelCaseValue'}}}}, recursive=True) }}"
 
+  - name: Disable logs-tab feature
+    set_fact:
+      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'kiali_feature_flags': {'disabled_features': ['logs-tab'] }}}, recursive=True) }}"
+
   - name: The new Kiali CR to be tested
     debug:
       msg: "{{ current_kiali_cr }}"
@@ -193,3 +213,19 @@
       - kiali_configmap_resource.metadata.annotations.aaa == 'bbb'
       - kiali_configmap_resource.metadata.annotations.camelCaseName == 'camelCaseValue'
       fail_msg: "Missing configmap annotations: {{ kiali_configmap_resource }}"
+
+  - name: Get Kiali Role
+    vars:
+      instance_name: "{{ kiali.instance_name | default('kiali') }}"
+    k8s_info:
+      api_version: rbac.authorization.k8s.io/v1
+      kind: Role
+      namespace: "{{ kiali.install_namespace }}"
+      label_selectors:
+      - "app.kubernetes.io/instance={{ instance_name }}"
+    register: kiali_role_raw
+
+  - name: Make sure Kiali Role has disabled access to pods/log
+    assert:
+      that:
+      - kiali_role_raw.resources[0].rules | to_yaml is not search('pods/log')

roles/default/kiali-deploy/defaults/main.yml

@@ -236,6 +236,7 @@ kiali_defaults:
       - istio-ca-secret
     clustering:
       enabled: true
+    disabled_features: []
     istio_injection_action: true
     istio_upgrade_action: false
     ui_defaults:

roles/default/kiali-deploy/templates/kubernetes/role-viewer.yaml

@@ -11,7 +11,9 @@ rules:
   resources:
   - configmaps
   - endpoints
+{% if 'logs-tab' not in kiali_vars.kiali_feature_flags.disabled_features %}
   - pods/log
+{% endif %}
   verbs:
   - get
   - list

roles/default/kiali-deploy/templates/kubernetes/role.yaml

@@ -11,7 +11,9 @@ rules:
   resources:
   - configmaps
   - endpoints
+{% if 'logs-tab' not in kiali_vars.kiali_feature_flags.disabled_features %}
   - pods/log
+{% endif %}
   verbs:
   - get
   - list

roles/default/kiali-deploy/templates/openshift/role-viewer.yaml

@@ -11,7 +11,9 @@ rules:
   resources:
   - configmaps
   - endpoints
+{% if 'logs-tab' not in kiali_vars.kiali_feature_flags.disabled_features %}
   - pods/log
+{% endif %}
   verbs:
   - get
   - list

roles/default/kiali-deploy/templates/openshift/role.yaml

@@ -11,7 +11,9 @@ rules:
   resources:
   - configmaps
   - endpoints
+{% if 'logs-tab' not in kiali_vars.kiali_feature_flags.disabled_features %}
   - pods/log
+{% endif %}
   verbs:
   - get
   - list