Repository navigation
fix: Show ALB logs only to people who can query them - #1628
Merged
Merged
Conversation
The ALB logs panel was gated on o11y.miloapis.com/logs.get. With Milo's subresource authorization on, a log query is reviewed twice instead: the aggregator hop reads /logs/loki/api/v1/... as resource logs, name loki, subresource api (logs/api.get), and queryapi then reviews its own route as logs.query with no name, subresource or namespace. A custom role holding only logs.get saw the panel and got a 403 on every query, and a role holding the new permissions was hidden. The portal's permission checks could not express a subresource: the BFF schema stripped unknown fields, so the field never reached Milo. Key changes: - thread an optional subresource from usePermission through the BFF schema, RbacService and the SelfSubjectAccessReview payload, and include it in the query cache key and the bulk dedupe identity - accept queryapi's query verb in permission checks - gate the panel on both reviews: logs/api.get with name loki, and logs.query, each with an empty namespace at project scope The provider resolves logs/api.get with name loki against the Logs:loki instance plus the project, kind root and scope root, so including the name also honors an instance-level binding, as the real request does. The new tests fail against the previous code (12 failures) and pass with this change. Fixes #1627
🧪 Test Summary
Need another run? Use Re-run failed jobs: one shard costs a few minutes, the whole workflow about 26. |
scotwells
approved these changes
Oct 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
People on custom roles could see the load balancer logs panel and then hit a permission error on every query, while others with real access had it hidden.
Since Milo began checking subresource permissions, a log query passes two checks that the panel's permission check never asked about.
The panel now shows only when both checks pass, which needed permission checks in the portal to carry a subresource through to Milo.
The Cypress component and end-to-end suites were not run.
Test plan
Fixes #1627