* feat(RBAC) EE-1304 list ingresses of current namespace other than all namespaces at front end side
* feat(RBAC) EE-1304 remove list ingresses from clusterrole
Co-authored-by: Simon Meng <simon.meng@portainer.io>
* feat(kubeconfig) EE-1153 Introduce the ability to change the expiry of a kubeconfig
* feat(kubeconfig) EE-1153 pr feedback update
* feat(kubeconfig) EE-1153 code cleanup
Co-authored-by: Simon Meng <simon.meng@portainer.io>
* feat(nodes limits)Review the resource assignement when creating a Kubernetes application EE-437
* feat(nodes limits) review feedback EE-437
* feat(nodes limits) workaround for lodash cloneDeep not working in production mode EE-437
* feat(nodes limits) calculate max cpu of slide bar with floor function instead of round function EE-437
* feat(nodes limits) another review feedback EE-437
* feat(nodes limits) cleanup code EE-437
* feat(nodes limits) EE-437 pr feedback update
* feat(nodes limits) EE-437 rebase onto develop branch
* feat(nodes limits) EE-437 another pr feedback update
Co-authored-by: Simon Meng <simon.meng@portainer.io>
* feat(k8s/resource-pool): add the ability to mark/unmark resource pool as system
fix(kube/ns): check label to see if namespace is system
refactor(k8s/namespaces): rename variables
feat(kubernetes): toggle system state in the server (#5361)
fix(app/resource-pool): UI fixes
feat(app/resource-pool): add confirmation modal when unamrking system namespace
* refactor(app): review changes
* feat(app/namespaces): introduce store to retrieve namespace system status without changing all the kubernetes models
refactor(app/namespaces): remove unused code first introduced for system tagging
fix(app/namespaces): cache namespaces to retrieve system status regardless of namespace reference format
refactor(app): migrate namespace store from helper to a separate singleton
refactor(app): remove KubernetesNamespaceHelper from DI cycle
* refactor(app): normalize usage of KubernetesNamespaceHelper functions
* refactor(app/k8s): change namespace store to functions instead of class
Co-authored-by: LP B <xAt0mZ@users.noreply.github.com>
* feat(analytics): add apis for event tracking
feat(api): fetch instanceID
feat(state): set instance id and version on matomo
refactor(state): export validation of app state
feat(analytics): update dimensions
refactor(analytics): move matomo to module
feat(analytics): disable analytics on non production
feat(analytics): track event metadata
refactor(analytics): clean push function
refactor(analytics): rename init function
feat(analytics): track user role
feat(analytics): track user global role
fix(stacks): remove event tracking for stack create
* style(analytics): remove TODO
* feat(build): add testing env
* fix(advance deploy): EE-1141 A standard user can escalate to cluster administrator privileges on Kubernetes
* fix(advance deploy): EE-1141 reuse existing token cache when do deployment
* fix: EE-1141 use user's SA token to exec pod command
* fix: EE-1141 stop advanced-deploy or pod-exec if user's SA token is empty
* fix: EE-1141 resolve merge conflicts
Co-authored-by: Simon Meng <simon.meng@portainer.io>
* EE oauth team memberships feature teaser
* bugfix: deleting a default team should reset default team id to 0
* error wrapping, refactor team deletion code
* intermediate commit
* feat(registry): backport ProGet registry to CE (#954)
* backport EE changes
* label updates and remove auth-toggle
Co-authored-by: Dennis Buduev <dennis.buduev@portainer.io>
* fix(stack) ignore username and password when authentication is disabled EE-161
* fix(stack) ignore username and password when authentication is disabled for stack creation EE-161
Co-authored-by: Simon Meng <simon.meng@portainer.io>
* fix(k8s) cleaning up namespace access policies when removing users or teams from endpoint or endpoint group EE-718
* fix(k8s) minor code cleanup EE-718
Co-authored-by: Simon Meng <simon.meng@portainer.io>
* feat(git): save git config when creating stack (#5048)
* feat(git): save git config when creating stack
* chore(fs): test fileExists
* fix(git): fix tests to use CloneRepository
* refactor(git): move options to new object
* feat(stacks): redeploy git stack api (#5112)
* feat(stacks): redeploy git stacks form
[EE-666]
* feat(stack): show loading after confirmation
* fix(stacks): show same size description
* fix(stacks): reload state when deployed
* feat(stacks): set stopped stacks status to activate when updating
* feat(stacks): backup stack folder before cloning
* feat(stacks): don't accept prune and env on update git
Co-authored-by: Chaim Lev-Ari <chiptus@users.noreply.github.com>
Co-authored-by: Chaim Lev-Ari <chiptus@gmail.com>
* add updateSettingsToDB28 func and test
* update DBversion const
* migration func naming modification
* feat(oauth): add sso, hide internal auth teaser and logout options. (#5039)
* cleanup and make helper func for unit testing
* dbversion update
* feat(publicSettings): public settings response modification for OAuth SSO EE-608 (#5062)
* feat(oauth): updated logout logic with logoutUrl. (#5064)
* add exclusive token generation for OAuth
* swagger annotation revision
* add unit test
* updates based on tech review feedback
* feat(oauth): updated oauth settings model
* feat(oauth): added oauth logout url
* feat(oauth): fixed SSO toggle and logout issue.
* set SSO to ON by default
* update migrator unit test
* set SSO to true by default for new instance
* prevent applying the SSO logout url to the initial admin user
Co-authored-by: fhanportainer <79428273+fhanportainer@users.noreply.github.com>
Co-authored-by: Felix Han <felix.han@portainer.io>
* feat(stack): add the ability for an administrator user to manage orphaned stacks (#4397)
* feat(stack): apply small font size to the information text of associate (#4397)
Co-authored-by: Simon Meng <simon.meng@portainer.io>
* refactor(http/kube): convert compose format
* feat(kube/deploy): deploy to agent
* feat(kube/deploy): show more details about error
* refactor(kube): return string from deploy
* feat(kube/deploy): revert to use local kubectl
* Revert "feat(kube/deploy): revert to use local kubectl"
This reverts commit 7c4a1c70
* feat(kube/deploy): GH#4321 use the v2 version of agent api instead of v3
Co-authored-by: Chaim Lev-Ari <chiptus@gmail.com>
Co-authored-by: Simon Meng <simon.meng@portainer.io>
* feat(dockerhub): introduce local status endpoint
* feat(proxy): rewrite request with dockerhub credentials
* feat(endpoint): check env type
* feat(endpoint): check for local endpoint
* feat(docker): introduce client side service to get limits
* feat(container): add info about rate limits in container
* feat(dockerhub): load rate limits just for specific endpoints
* feat(images): show specific dockerhub messages for admin
* feat(service-create): show docker rate limits
* feat(service-edit): show rate limit messages
* fix(images): fix loading of page
* refactor(images): move rate limits check to container
* feat(kubernetes): proxy agent requests
* feat(kubernetes/apps): show pull limits in application creation
* refactor(image-registry): move warning to end of field
* fix(image-registry): show right message for admin
* fix(images): silently fail when loading rate limits
* fix(kube/apps): use new rate limits comp
* fix(images): move rate warning to end
* fix(registry): move search to right place
* fix(service): remove service warning
* fix(endpoints): check if kube endpoint is local
* fix windows build
* fix(endpoints): show correct values of security settings (#4889)
* fix(app): EndpointProvider fallback on URL EndpointID when no endpoint is selected (#4892)
* fix(templates): App templates not loading with error in browser console (#4895)
* fix(kube/config): show used key warning when needed (#4890)
fix [CE-469]
- recalculate duplcate keys when they are changed
- show used warning on duplicate keys
* fix(k8s): CE-471 variables from configuration showing on environment variables section on application edit screen (#4896)
* fix(k8s): CE-471 variables from configuration showing on environment variables section on application edit screen
* fix(k8s): CE-471 avoid to remove value path of env when patch k8s deployment, as the value path does not exist if env variable has empty value.
Co-authored-by: Simon Meng <simon.meng@portainer.io>
Co-authored-by: Dmitry Salakhov <to@dimasalakhov.com>
Co-authored-by: Chaim Lev-Ari <chiptus@users.noreply.github.com>
Co-authored-by: LP B <xAt0mZ@users.noreply.github.com>
Co-authored-by: Maxime Bajeux <max.bajeux@gmail.com>
Co-authored-by: cong meng <mcpacino@gmail.com>
Co-authored-by: Simon Meng <simon.meng@portainer.io>
* feat(k8s): better form validation for configuration keys (#4728) (#4733)
Co-authored-by: Simon Meng <simon.meng@portainer.io>
* feat(home): show edge valid tag
* fix(endpoint): show right heartbeat
* style(endpoints): add some comments
Co-authored-by: cong meng <mcpacino@gmail.com>
Co-authored-by: Simon Meng <simon.meng@portainer.io>
* refactor(stack): create unique name function
* refactor(stack): change stack resource control id
* feat(stacks): validate stack unique name in endpoint
* feat(stacks): prevent name collision with external stacks
* refactor(stacks): move resource id util
* refactor(stacks): supply resource id util with name and endpoint
* fix(docker): calculate swarm resource id
* feat(stack): prevent migration if stack name already exist
* feat(authorization): use stackutils
* feat(custom-templates): switching a template to standalone makes it disappear in swarm mode
* feat(custom-template): disable deploy button and add an error message
* fix(custom-template): invert variable
* fix(custom-templates): put the warning message below the button
* feat(compose): add docker-compose wrapper
ce-187
* fix(compose): pick compose implementation upon startup
* Add static compose build for linux
* Fix wget
* Fix platofrm specific docker-compose download
* Keep amd64 architecture as download parameter
* Add tmp folder for docker-compose
* fix: line endings
* add proxy server
* logs
* Proxy
* Add lite transport for compose
* Fix local deployment
* refactor: pass proxyManager by ref
* fix: string conversion
* refactor: compose wrapper remove unused code
* fix: tests
* Add edge
* Fix merge issue
* refactor: remove unused code
* Move server to proxy implementation
* Cleanup wrapper and manager
* feat: pass max supported compose syntax version with each endpoint
* fix: pick compose syntax version
* fix: store wrapper version in portainer
* Get and show composeSyntaxMaxVersion at stack creation screen
* Get and show composeSyntaxMaxVersion at stack editor screen
* refactor: proxy server
* Fix used tmp
* Bump docker-compose to 1.28.0
* remove message for docker compose limitation
* fix: markup typo
* Rollback docker compose to 1.27.4
* * attempt to fix the windows build issue
* * attempt to debug grunt issue
* * use console log in grunt file
* fix: try to fix windows build by removing indirect deps from go.mod
* Remove tmp folder
* Remove builder stage
* feat(build/windows): add git for Docker Compose
* feat(build/windows): add git for Docker Compose
* feat(build/windows): add git for Docker Compose
* feat(build/windows): add git for Docker Compose
* feat(build/windows): add git for Docker Compose
* feat(build/windows): add git for Docker Compose - fixed verbose output
* refactor: renames
* fix(stack): get endpoint by EndpointProvider
* fix(stack): use margin to add space between line instead of using br tag
Co-authored-by: Stéphane Busso <stephane.busso@gmail.com>
Co-authored-by: Simon Meng <simon.meng@portainer.io>
Co-authored-by: yi-portainer <yi.chen@portainer.io>
Co-authored-by: Steven Kang <skan070@gmail.com>
* feat(docker/stacks): add creation and update dates
* feat(docker/stacks): put ownership column as the last column
* feat(docker/stacks): fix the no stacks message
* refactor(docker/stacks): make external stacks helpers more readable
* feat(docker/stacks): add updated and created by
* feat(docker/stacks): toggle updated column
* refactor(datatable): create column visibility component
Co-authored-by: alice groux <alice.grx@gmail.com>
* feat(docker/stacks): add creation and update dates
* feat(docker/stacks): put ownership column as the last column
* feat(docker/stacks): fix the no stacks message
* feat(k8s/configure): separate ingress class name and ingress class type
* feat(k8s/resource-pool): ability to add custom annotations to ingress classes on RP create/edit
* feat(k8s/ingresses): remove 'allow users to use ingress' switch
* feat(k8s/configure): minor UI update
* feat(k8s/resource-pool): minor UI update
* feat(k8s/application): update ingress route form validation
* refactor(k8s/resource-pool): remove console.log statement
* feat(k8s/resource-pool): update ingress annotation placeholders
* feat(k8s/configure): add pattern form validation on ingress class
* fix(k8s/resource-pool): automatically associate ingress class to ingress
* fix(k8s/resource-pool): fix invalid ingress when updating a resource pool
* fix(k8s/resource-pool): update ingress rewrite target annotation value
* feat(k8s/application): ingress form validation
* fix(k8s/application): squash ingress rules with empty host inside a single one
* feat(k8s/resource-pool): ingress host validation
* fix(k8s/resource-pool): rewrite rewrite option and only display it for ingress of type nginx
* feat(k8s/application): do not expose ingress applications over node port
* feat(k8s/application): add specific notice for ingress
Co-authored-by: Anthony Lapenna <lapenna.anthony@gmail.com>
* feat(k8s/endpoint): expose ingress controllers on endpoints
* feat(k8s/applications): add ability to expose applications over ingress - missing RP and app edits
* feat(k8s/application): add validation for ingress routes
* feat(k8s/resource-pools): edit available ingress classes
* fix(k8s/ingress): var name refactor was partially applied
* feat(kubernetes): double validation on RP edit
* feat(k8s/application): app edit ingress update + formvalidation + UI rework
* feat(k8s/ingress): dictionary for default annotations on ingress creation
* fix(k8s/application): temporary fix + TODO dev notice
* feat(k8s/application): select default ingress of selected resource pool
* feat(k8s/ingress): revert ingressClassName removal
* feat(k8s/ingress): admins can now add an host to ingress in a resource pool
* feat(k8s/resource-pool): list applications using RP ingresses
* feat(k8s/configure): minor UI update
* feat(k8s/configure): minor UI update
* feat(k8s/configure): minor UI update
* feat(k8s/configure): minor UI update
* feat(k8s/configure): minor UI update
* fix(k8s/ingresses): remove host if undefined
* feat(k8s/resource-pool): remove the activate ingresses switch
* fix(k8s/resource-pool): edditing an ingress host was deleting all the routes of the ingress
* feat(k8s/application): prevent app deploy if no ports to publish and publishing type not internal
* feat(k8s/ingress): minor UI update
* fix(k8s/ingress): allow routes without prepending /
* feat(k8s/application): add form validation on ingress route
Co-authored-by: Anthony Lapenna <lapenna.anthony@gmail.com>
* feat(applications): update UI to use existing volumes
* feat(application): Add the ability to use existing volumes when creating an application
* feat(application): Existing persisted folders should default to associated volumes
* feat(application): add form validation to existing volume
* feat(application): remove the ability to use an existing volume with statefulset application
* feat(k8s/applications): minor UI update
* feat(k8s/application): minor UI update
* feat(volume): allow to increase volume size and few other things
* feat(volumes): add the ability to allow volume expansion
* fix(storage): fix the storage patch request
* fix(k8s/applications): remove conflict leftover
* feat(k8s/configure): minor UI update
* feat(k8s/volume): minor UI update
* fix(storage): change few things
Co-authored-by: Anthony Lapenna <lapenna.anthony@gmail.com>
* refactor(oauth): move oauth client code
* feat(oauth): move extension code into server code
* feat(oauth): enable oauth without extension
* refactor(oauth): make it easier to remove providers
* feat(application): add horizontalpodautoscaler creation
* feat(application): Add the ability to set the auto-scale policy of an application
* feat(k8s/application): minor UI update
* fix(application): set api version and prevent to use hpa with global deployment type
* feat(settings): add a switch to enable features based on server metrics
* feat(k8s/applications): minor UI update
Co-authored-by: Anthony Lapenna <lapenna.anthony@gmail.com>
* feat(containers): enforce disable bind mounts
* refactor(docker): move check for endpoint admin to a function
* feat(docker): check if service has bind mounts
* feat(services): allow bind mounts for endpoint admin
* feat(container): enable bind mounts for endpoint admin
* fix(services): fix typo
* feat(settings): introduce settings to allow/disable
* feat(settings): update the setting
* feat(docker): prevent user from using caps if disabled
* refactor(stacks): revert file
* style(api): remove portainer ns
* feat(stacks): add a setting to disable the creation of stacks for non-admin users
* feat(settings): introduce a setting to prevent non-admin from stack creation
* feat(settings): update stack creation setting
* feat(settings): fail stack creation if user is non admin
* fix(settings): save preventStackCreation setting to state
* feat(stacks): disable add button when settings is enabled
* format(stacks): remove line
* feat(stacks): setting to hide stacks from users
* feat(settings): rename disable stacks setting
* refactor(settings): rename setting to disableStackManagementForRegularUsers
* feat(settings): hide stacks for non admin when settings is set
* refactor(settings): replace disableDeviceMapping with allow
* feat(dashboard): hide stacks if settings disabled and non admin
* refactor(sidebar): check if user is endpoint admin
* feat(settings): set the default value for stack management
* feat(settings): rename field label
* fix(sidebar): refresh show stacks state
* fix(docker): hide stacks when not admin
* feat(settings): add setting to disable device mapping for regular users
* feat(settings): introduce device mapping service
* feat(containers): hide devices field when setting is on
* feat(containers): prevent passing of devices when not allowed
* feat(stacks): prevent non admin from device mapping
* feat(stacks): disallow swarm stack creation for user
* refactor(settings): replace disableDeviceMapping with allow
* fix(stacks): remove check for disable device mappings from swarm
* feat(settings): rename field to disable
* feat(settings): supply default value for disableDeviceMapping
* feat(container): check for endpoint admin
* style(server): sort imports
* feat(containers): prevent non-admin users from running containers using the host namespace pid (#3970)
* feat(containers): Prevent non-admin users from running containers using the host namespace pid
* feat(containers): add rbac check for swarm stack too
* feat(containers): remove forgotten conflict
* feat(containers): init EnableHostNamespaceUse to true and return 403 on forbidden action
* feat(containers): change enableHostNamespaceUse to restrictHostNamespaceUse in html
* feat(settings): rename EnableHostNamespaceUse to AllowHostNamespaceForRegularUsers
* feat(database): trigger migration for AllowHostNamespace
* feat(containers): check container creation authorization
Co-authored-by: Maxime Bajeux <max.bajeux@gmail.com>
* feat(containers): Ensure users cannot create privileged containers via the API
* feat(containers): add rbac check in stack creation
Co-authored-by: Maxime Bajeux <max.bajeux@gmail.com>
Chaim Lev-Ari