[9614] Seccomp Profile added to POD and Container page of all Worklods | Pod Name Validation fixed by marcelofukumoto · Pull Request #16048 · rancher/dashboard

marcelofukumoto · 2025-11-26T18:57:00Z

Summary

Fixes #9614

Added Seccomp Profile to the POD (create/edit) and Container (create/edit) Security Context
- It contains 4 options
  - None, RuntimeDefault, Localhost, Unconfined
  - Some ref: https://kubernetes.io/docs/reference/node/seccomp/
    - Localhost has a second Input called Localhost Profile which is the Path of the file used
    - The new input requires a value (validation)
      - Added the (!) showing error for the Tab and the Security Context on the lsit
- As default for POD the option selected is RuntimeDefault
- As default for Container the option select is None
- Those options are added to all Workloads
- Pods cannot edit it (error)
  - But other workloads, they can
Fixed a validation for the NAME of the POD [BUG-9614-1]
- The validation for the "Create" button to be enabled was not considering NAME
Fixed a bug where the YAML file got the config lost if changes the security context [BUG-9614-2]
Merged the Security from Pod and Container, adding a conditional if container or pod.
Change accessibility only for security context
- Added focus on list click
- Added some new texts for label
- Fieldset added to the page

Occurred changes and/or fixed issues

#9614

pkg/rancher-components/src/components/Form/Checkbox/Checkbox.vue - [ACCESSIBILITY] Added some focus for Checkbox and styles as well
pkg/rancher-components/src/components/LabeledTooltip/LabeledTooltip.vue - [ACCESSIBILITY] Added Tooltip text to the Tooltip
shell/assets/styles/base/_typography.scss - [ACCESSIBILITY] Changed Typography to use H3 style for Legend, so we can use Fieldset
shell/assets/translations/en-us.yaml - Added new texts for the SeccompProfile fields, Added texts for accessibility, title for capabilities
shell/components/form/LabeledSelect.vue - [ACCESSIBILITY] Added for the Value to be added to accessibility
shell/components/form/SeccompProfile.vue - New component create to be reused on the Pod and Container pages to represent the SeccompProfile option
shell/components/form/Security.vue - Changed UI to accept container and pod changes, changed Yes/No Radio to Checkbox
shell/components/form/tests/LabeledSelect.test.ts - Test changed because of the label
shell/components/form/tests/SeccompProfile.test.js - Added test for the new component
shell/components/form/tests/Security.test.ts - Refactored to have more detailed tests
shell/edit/workload/tests/index.test.ts - Removed podFsGroup, not using anymore on the new structure
shell/edit/workload/index.vue - Security Context of the pod
shell/edit/workload/mixins/workload.js - Logic of the workload, added validation logics for the new Seccomp fields
shell/models/pod.js - Added the missing custom validation for the name on the pod model [BUG-9614-1]

Technical notes summary

The Update of the security context of the pod happens at the shell/edit/workload/mixins/workload.js for the podFsGroup. I could use the same place to update the changes on the SeccompProfile, but I decided to pass the podTemplateSpec directly to the Pod
I made sure that the YAML file is not rewritten when changing security context for containers (pod seems ok) [BUG-9614-2]

Areas or cases that should be tested

All workloads CREATE for POD and CONTAINERS
All workloads EDIT for POD and CONTAINER
Test cases on the PDF
Issue 9614 - 2.pdf

Areas which could experience regressions

Create and Edit for POD and CONTAINER were edited
Since there was many changes to the page structure, Security Context needs to be texted throughly

Screenshot/Video

Test results on the PDF
Issue 9614 - 2.pdf
Issue 9614 - 2 - UI Check.pdf

Checklist

The PR is linked to an issue and the linked issue has a Milestone, or no issue is needed
The PR has a Milestone
The PR template has been filled out
The PR has been self reviewed
The PR has a reviewer assigned
The PR has automated tests or clear instructions for manual tests and the linked issue has appropriate QA labels, or tests are not needed
The PR has reviewed with UX and tested in light and dark mode, or there are no UX changes
The PR has been reviewed in terms of Accessibility
The PR has considered, and if applicable tested with, the three Global Roles Admin, Standard User and User Base

…ds | Pod Name Validation fixed

… to Checkbox | Added title for Capabilities

…natory texts | Fixed tooltip aria labels and select, adding values

…d on create

…the Error on containers | Refactored the error based on those changes | Removed focus on tab based on feedback | Fixed test after using allContainers

richard-cox

Just a few minor questions and requests, otherwise looking good

shell/edit/workload/mixins/workload.js

richard-cox · 2026-01-16T11:10:40Z

shell/edit/workload/mixins/workload.js

+
    tabErrors() {
-      return { general: this.fvGetPathErrors(['image'])?.length > 0 };
+      const tabErrors = { podSecurityContext: this.fvGetPathErrors(['podTemplateSpec.securityContext.seccompProfile.localhostProfile'])?.length > 0 };


how come the image has been removed (not needed?) and localHostProfile added? i would have though it's both or neither?

It moved to the allContainers() at line 433.
Before the validation of the "image" was only applying to the "current" container showing, there was only ONE validation for it, and so it was bugged.
The correct is to apply the validation of the "image" for each container separately, so here it has been removed and added to the containers" validation.

Gotcha.

Missed this the first time around, generally we should avoid adding properties to the resource we will eventually save (that container.error object). Normally they would get persisted when the object is saved, but i think kube now sends a warning back. These are a bit different though

There's already an error object, so the issue exists already

The only way to produce the bug is to setup the form such that the errors exist --> edit as yaml --> save. This isn't something we would expect to happen often

Given above lets keep as is for the moment

There's the _init as well (not changed by this PR), which in theory i think we strip before sending. Not sure

Thanks! Interesting to know. I just followed the same way that the Container Image was being done.
So to use the "spec" to control the UI is never a good idea. I think that happens on the computed "allContainers" which means that if we just use an UI Helper for the errors instead of using the "spec" would fix this problem.

As you said, it is already an issue now. Let's discuss, would be great to have an "issue" to track this one. But I think with the form changes, maybe the logic will disappear as well.

shell/models/pod.js

shell/components/form/Security.vue

richard-cox · 2026-01-16T11:26:18Z

shell/components/form/Security.vue

+      class="row"
+    >
+      <div class="col span-6">
+        <fieldset>


I think @mantis-toboggan-md is doing some work on the new form work which will be used an example for all new (and at some point existing) forms.

If we go with the fieldset + legend pattern it would be good to also do it there. If we're not sure can you bring up in the next demo session?

That seems like a good idea to share about it and why we should use fieldset + legends.
Instead of demo session, maybe we can have a meeting between us(me, you and @mantis-toboggan-md) first and discuss about it. Than after we got agreement or direction we can share on the demo.

Ok, we can shortcut and start a slack discussion in our team channel? I think it should be easy to get consensus there. Should be straight forward if Alex and myself are onboard

…dded comment for fvFormRulesets | created FORM_TYPES for the Security component

…profile-settings

marcelofukumoto · 2026-01-19T15:41:31Z

Changed applied as requested:
shell/assets/translations/en-us.yaml - Added localisation text
shell/components/form/Security.vue - Added _EDIT and new const FORM_TYPES created
shell/components/form/tests/Security.test.ts - Fixed test to use FORM_TYPES (this one since they are tests, I think would make sense to keep them as string
shell/edit/workload/index.vue - Changed to use FORM_TYPES
shell/edit/workload/mixins/workload.js - Added comments for the fvFormRulesets[0] to explain the details of implementation and changed the localisation

Merged master to fix conflict

shell/utils/validators/formRules/index.ts

marcelofukumoto added 5 commits November 20, 2025 19:41

[9614] Seccomp Profile added to POD and Container page of all Workloa…

e1f0df0

…ds | Pod Name Validation fixed

[9614] Merged security context for pod and container | Changed Radios…

8ae6652

… to Checkbox | Added title for Capabilities

[9614] Accessibility added | Focus on TAB | Some aria added for expla…

710aff5

…natory texts | Fixed tooltip aria labels and select, adding values

[9614] Fixed the unit test | aria-label changes to have value

cbed170

[9614] Added conditional disable on focus, added default value for po…

8b753fe

…d on create

rancher-ui-project-bot bot assigned marcelofukumoto Nov 26, 2025

rancher-ui-project-bot bot added this to the v2.14.0 milestone Nov 26, 2025

marcelofukumoto requested review from kwwii, nwmac and richard-cox November 26, 2025 18:57

marcelofukumoto marked this pull request as draft November 26, 2025 18:57

marcelofukumoto added area/dashboard and removed area/dashboard labels Nov 26, 2025

marcelofukumoto added 4 commits November 26, 2025 20:14

[9614] Fixed lint and build error

7a8f239

[9614] Fixed e2e test for cloning pod

be8b73e

[9614] Fixed some text based on designer feedback | Fixed a bug with …

4db818b

…the Error on containers | Refactored the error based on those changes | Removed focus on tab based on feedback | Fixed test after using allContainers

[9614] Fixed the text for the Localhost Profile as suggested, added Path

effabfb

marcelofukumoto marked this pull request as ready for review November 28, 2025 13:00

richard-cox requested changes Jan 19, 2026

View reviewed changes

marcelofukumoto added 2 commits January 19, 2026 16:28

[9614] Add localisation to missing text | changed 'edit' to _EDIT | a…

7aa2756

…dded comment for fvFormRulesets | created FORM_TYPES for the Security component

Merge branch 'master' into 9614-create-pod-from-ui-is-missing-seccomp…

ea97f83

…profile-settings

marcelofukumoto requested a review from richard-cox January 23, 2026 10:53

richard-cox reviewed Jan 26, 2026

View reviewed changes

shell/utils/validators/formRules/index.ts Outdated Show resolved Hide resolved

[9614] Fixed using the wrong message for the localhostProfile error

4438109

richard-cox approved these changes Jan 26, 2026

View reviewed changes

marcelofukumoto merged commit b5cc0d1 into rancher:master Jan 26, 2026
37 checks passed

Conversation

marcelofukumoto commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Occurred changes and/or fixed issues

Technical notes summary

Areas or cases that should be tested

Areas which could experience regressions

Screenshot/Video

Checklist

Uh oh!

richard-cox left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

marcelofukumoto commented Jan 19, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

marcelofukumoto commented Nov 26, 2025 •

edited

Loading