Should be more clear 🙂

Marco, can you share which version of rancher have you installed? Moreover, would like to double check: did you take the charts from the opensuse OCI registry?

I did take the charts from the OCI registry but needed to unpack and create a .tgz file being able to install them. Both the CRDs and the Operator

Just created a MachineRegistration / Seed Image etc.. so all seems to work ok until now. Only the dashboard does not popup nicely for the OS Management

trying to reproduce the issue

Needed to refresh the admin password etc

Because the OCI images in the documentation are not usable in my case

Bu the Helm charts in the releases are totally different then the ones in the OCI registry

Using the unpacked OCI images

Just a strange mixup of couple of things.

But would be nice to understand what the UI is actually missing to show the correct content

Questo messaggio contiene elementi interattivi.

You can try to just create a brand new administrator user from the Rancher UI, that will have all the permissions

Otherwise, regular users should get the Elemental Administrator permissions

Questo messaggio contiene elementi interattivi.

under the hood, this creates a GlobalRoleBinding matching the GlobalRole (elemental-operator) to the User. So, if your user has name "u-myuser", something like:

apiVersion: <http://management.cattle.io/v3|management.cattle.io/v3>
globalRoleName: elemental-operator
kind: GlobalRoleBinding
metadata:
  name: grb-elemtomyuser
userName: u-myuser

that would grant the permissions. Anyway, I would do that through the Rancher UI, as it will correctly populate all the annotations and metadata to have a clean configuration there.

So, I would create a new admin user from Rancher UI

logout and login with it

check if everything works

@many-tiger-3407 So a normal Admin seems to be the problem.. A normal user with Elemental Administrator rights can see the dashboard.

An admin user with also the

Elemental Administrator

checked also does not seem to work..

@acceptable-belgium-2684, I have taken a look at the Admin roles in Rancher: admin users are granted a GlobalRoleBinding against the Admin GlobalRole. The Admin GlobalRole as rules to match all kind of resources with all kind of operations. On a fresh Rancher cluster it looks like:

apiVersion: <http://management.cattle.io/v3|management.cattle.io/v3>
builtin: true
description: ""
displayName: Admin
kind: GlobalRole
metadata:
  annotations:
    <http://authz.management.cattle.io/cr-name|authz.management.cattle.io/cr-name>: cattle-globalrole-admin
    <http://lifecycle.cattle.io/create.mgmt-auth-gr-controller|lifecycle.cattle.io/create.mgmt-auth-gr-controller>: "true"
  creationTimestamp: "2023-07-03T15:25:56Z"
  finalizers:
  - <http://controller.cattle.io/mgmt-auth-gr-controller|controller.cattle.io/mgmt-auth-gr-controller>
  generation: 1
  labels:
    <http://authz.management.cattle.io/bootstrapping|authz.management.cattle.io/bootstrapping>: default-globalrole
    <http://cattle.io/creator|cattle.io/creator>: norman
  name: admin
  resourceVersion: "1909"
  uid: 7592bf41-906a-4717-95e6-0f935ada0627
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
- nonResourceURLs:
  - '*'
  verbs:
  - '*'

As you can see, it allows access to all kind of resources, Elemental included.

Not sure what happened on your cluster 🤔 But I would expect admin users to have a GlobalRoleBinding matching against the Admin GlobalRole, that should be like above.

I honestly cannot see any issue with elemental: we provide the elemental-operator global role for not admin users, while admin ones should be granted access by the default Admin - match-all-resources global role.

I would review the RBAC rules on your cluster, probably something is not right there... still wondering what could have happened 🤔