From caaf4f90d49addd6d092b2ca606c03723bfd142c Mon Sep 17 00:00:00 2001
From: IvanHunters <ivan.okhotnikov@aenix.io>
Date: Thu, 30 Apr 2026 00:37:28 +0300
Subject: [PATCH] fix(dashboard): restrict RBAC to cluster-scoped resources and
 cleanup naming

Remove namespace-scoped resources (tenantsecrets, tenantnamespaces,
tenantmodules, virtualmachineinstances, virtualmachineinstances/vnc) from
the cozystack-dashboard-readonly ClusterRole bound to system:authenticated.
These resources must be accessed via per-namespace RoleBindings created by
the tenant operator, not through a cluster-wide grant to all authenticated
users.

Only truly cluster-scoped, public-by-design resources remain in the
ClusterRole: applicationdefinitions, storageclasses, backupclasses,
and dashboard.cozystack.io customization resources.

Also rename the leftover incloud-web-web-user-edit ClusterRoleBinding to
cozystack-dashboard-cluster-admin to match the new naming convention, and
declare Makefile targets as .PHONY.

Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>
---
 packages/system/dashboard/Makefile            |  2 ++
 .../clusterrolebinding-web-user-edit.yaml     |  2 +-
 packages/system/dashboard/templates/rbac.yaml | 24 -------------------
 3 files changed, 3 insertions(+), 25 deletions(-)

diff --git a/packages/system/dashboard/Makefile b/packages/system/dashboard/Makefile
index ed2ba890..1f74e259 100644
--- a/packages/system/dashboard/Makefile
+++ b/packages/system/dashboard/Makefile
@@ -4,6 +4,8 @@ export NAMESPACE=cozy-$(NAME)
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
+.PHONY: image image-console image-token-proxy
+
 image: image-console image-token-proxy
 
 CONSOLE_REPO ?= https://github.com/cozystack/cozystack-ui.git
diff --git a/packages/system/dashboard/templates/clusterrolebinding-web-user-edit.yaml b/packages/system/dashboard/templates/clusterrolebinding-web-user-edit.yaml
index 4d951787..00df8018 100644
--- a/packages/system/dashboard/templates/clusterrolebinding-web-user-edit.yaml
+++ b/packages/system/dashboard/templates/clusterrolebinding-web-user-edit.yaml
@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   annotations: {}
-  name: incloud-web-web-user-edit
+  name: cozystack-dashboard-cluster-admin
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/packages/system/dashboard/templates/rbac.yaml b/packages/system/dashboard/templates/rbac.yaml
index b37a68b2..c64e851f 100644
--- a/packages/system/dashboard/templates/rbac.yaml
+++ b/packages/system/dashboard/templates/rbac.yaml
@@ -12,16 +12,6 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - core.cozystack.io
-  resources:
-  - tenantmodules
-  - tenantnamespaces
-  - tenantsecrets
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - dashboard.cozystack.io
   resources:
@@ -46,20 +36,6 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - kubevirt.io
-  resources:
-  - virtualmachineinstances
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - subresources.kubevirt.io
-  resources:
-  - virtualmachineinstances/vnc
-  verbs:
-  - get
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding