OCPBUGS-111081: Fix Installed Operators page error for namespace-scoped RBAC users

[platex-rehor-bot]

Analysis / Root cause:

When the Firehose component was replaced by React hooks in MultiListPage (as part of CONSOLE-5026), the loadError computation in list-page.tsx lost the check that excluded resources declared with optional: true from contributing to the page's fatal error.

In 4.21, firehose.jsx explicitly filtered optional resources out before computing loadError:

const required = _.filter(resources, (r) => !r.optional);
const loadError = worstError(_.map(required, 'loadError').filter(Boolean));

In 4.22, the replacement code in list-page.tsx uses Object.values(watchedResources) which discards the resource key, and has no reference to the optional flag — so any resource error, including from optional resources, becomes a fatal page error.

The Installed Operators page declares CatalogSource as optional: true (cluster-scoped lookup used only for catalog-health badges). For users whose RBAC is delivered entirely via namespace-scoped RoleBindings (no ClusterRoleBinding), this cluster-scoped fetch returns 403, which now becomes a fatal page error instead of being silently tolerated.

Solution description:

Modified the loadError computation in MultiListPage to cross-reference each watched resource's key against the watchResources input config (which still carries the optional flag). Resources declared optional: true are excluded from the fatal error calculation, restoring the 4.21 behavior.

The fix is in the shared MultiListPage infrastructure (list-page.tsx), not in any Operators-specific code, so it correctly handles all current and future uses of optional: true across the console.

Screenshots / screen recording:

Test setup:

1. On an OCP 4.22+ cluster, create a namespace and install any catalog Operator into it.
2. Create a test user with namespace-scoped RoleBindings only (no ClusterRoleBinding).
3. Log in as the test user and navigate to Operators → Installed Operators for that namespace.

Test cases:

• Verify the Installed Operators page renders correctly for users with namespace-scoped RBAC only (no cluster-scope CatalogSource access).
• Verify the page still shows errors for non-optional resource failures (e.g., if the ClusterServiceVersion fetch itself fails).
• Unit tests added to verify optional resource errors are excluded from loadError and non-optional errors are preserved.

Browser conformance:

• Chrome
• Firefox
• Safari (or Epiphany on Linux)

Additional info:

• Jira: OCPBUGS-111081
• Regression introduced by openshift/console#16096 (Firehose → hooks migration)
• Reported via Red Hat support case 04489721 (Ford Motor Company)
• Detailed root cause analysis available in the Jira ticket comments

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Improved list page error handling for watched resources.
  • Errors from optional resources no longer prevent the list from displaying.
  • Non-optional resource errors are now correctly surfaced to the list.
  • Ignored expected “resource unavailable” errors when determining page-level failures.

• Tests

  • Added coverage for optional and required resource error scenarios.

[openshift-ci-robot]

@platex-rehor-bot: This pull request references Jira Issue OCPBUGS-111081, which is invalid:

• expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Analysis / Root cause:

When the Firehose component was replaced by React hooks in MultiListPage (as part of CONSOLE-5026), the loadError computation in list-page.tsx lost the check that excluded resources declared with optional: true from contributing to the page's fatal error.

In 4.21, firehose.jsx explicitly filtered optional resources out before computing loadError:

const required = _.filter(resources, (r) => !r.optional);
const loadError = worstError(_.map(required, 'loadError').filter(Boolean));

In 4.22, the replacement code in list-page.tsx uses Object.values(watchedResources) which discards the resource key, and has no reference to the optional flag — so any resource error, including from optional resources, becomes a fatal page error.

The Installed Operators page declares CatalogSource as optional: true (cluster-scoped lookup used only for catalog-health badges). For users whose RBAC is delivered entirely via namespace-scoped RoleBindings (no ClusterRoleBinding), this cluster-scoped fetch returns 403, which now becomes a fatal page error instead of being silently tolerated.

Solution description:

Modified the loadError computation in MultiListPage to cross-reference each watched resource's key against the watchResources input config (which still carries the optional flag). Resources declared optional: true are excluded from the fatal error calculation, restoring the 4.21 behavior.

The fix is in the shared MultiListPage infrastructure (list-page.tsx), not in any Operators-specific code, so it correctly handles all current and future uses of optional: true across the console.

Screenshots / screen recording:

Test setup:

1. On an OCP 4.22+ cluster, create a namespace and install any catalog Operator into it.
2. Create a test user with namespace-scoped RoleBindings only (no ClusterRoleBinding).
3. Log in as the test user and navigate to Operators → Installed Operators for that namespace.

Test cases:

• Verify the Installed Operators page renders correctly for users with namespace-scoped RBAC only (no cluster-scope CatalogSource access).
• Verify the page still shows errors for non-optional resource failures (e.g., if the ClusterServiceVersion fetch itself fails).
• Unit tests added to verify optional resource errors are excluded from loadError and non-optional errors are preserved.

Browser conformance:

• Chrome
• Firefox
• Safari (or Epiphany on Linux)

Additional info:

• Jira: OCPBUGS-111081
• Regression introduced by openshift/console#16096 (Firehose → hooks migration)
• Reported via Red Hat support case 04489721 (Ford Motor Company)
• Detailed root cause analysis available in the Jira ticket comments

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 309249a7-7f6b-4b4a-8dff-dddaf471401d

📥 Commits

Reviewing files that changed from the base of the PR and between 5ca58f2 and 5bb3bc8.

📒 Files selected for processing (1)

• frontend/public/components/factory/list-page.tsx

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

MultiListPage now ignores errors from optional watched resources while preserving fatal errors from required resources. Tests cover both behaviors through the ListComponent loadError prop.

Changes

Watch error handling

Layer / File(s)	Summary
Filter watched resource errors frontend/public/components/factory/list-page.tsx	MultiListPage derives loadError by resource key, excludes NoModelError, ignores errors from optional resources, and updates when watch results or configuration changes.
Validate error propagation frontend/public/components/factory/__tests__/list-page.spec.tsx	Tests verify that optional resource errors produce an undefined loadError, while required resource errors reach ListComponent.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 5bb3b

This localized change prevents optional resource permission errors from blocking the Installed Operators page while preserving failures for required resources; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: fsgreco, spadgett, logonoff

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Jira issue and the primary fix for namespace-scoped RBAC users on the Installed Operators page.
Description check	✅ Passed	The description includes the root cause, solution, test setup, test cases, additional context, and required Jira reference. Browser checks remain unmarked and reviewer assignments are not listed, but …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes a TypeScript Jest test file and list-page.tsx; it adds no Ginkgo tests. The added test titles are static descriptive strings: `does not treat errors from optional reso…
Test Structure And Quality	✅ Passed	PASS — the custom check applies only to Ginkgo test code. This pull request changes a TypeScript React test file using Jest and React Testing Library (describe, it, expect, jest.mock) and chan…
Microshift Test Compatibility	✅ Passed	The pull request adds only frontend TypeScript/React unit tests and changes MultiListPage; it adds no Ginkgo e2e tests. The added tests use Jest describe/it and mock useK8sWatchResources, so t…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only two frontend TypeScript/TSX files. The added tests use Jest/React Testing Library describe and it, not Ginkgo e2e tests. They mock useK8sWatchResources and do not a…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only the frontend MultiListPage implementation and its unit tests. The diff adds no deployment manifests, operator code, controllers, replicas, affinity, topology spre…
Ote Binary Stdout Contract	✅ Passed	PASS: The PR changes only two frontend TypeScript/TSX files: list-page.tsx and its Jest spec. The diff adds MultiListPage error handling and test cases; it does not modify an OTE binary, main(),…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request adds Jest/React unit tests in list-page.spec.tsx, not new Ginkgo e2e tests. The tests mock useK8sWatchResources and perform no network or external service access. The added …
No-Weak-Crypto	✅ Passed	PASS: The PR diff only changes MultiListPage load-error filtering and adds unit tests for optional and required resource errors. No MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, crypto API, custom crypt…
Container-Privileges	✅ Passed	PASS: The pull request changes only two TypeScript/TSX files. The diff adds optional resource error handling and tests, with no container or Kubernetes manifests. Searches of the changed files found…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The PR adds no logging statements or log sinks. The changed production code only filters loadError entries before passing the value to ListComponent; it does not emit the error. The tests us…

Full details: Description check

Explanation

The description includes the root cause, solution, test setup, test cases, additional context, and required Jira reference. Browser checks remain unmarked and reviewer assignments are not listed, but these omissions are non-critical.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes a TypeScript Jest test file and list-page.tsx; it adds no Ginkgo tests. The added test titles are static descriptive strings: does not treat errors from optional resources as fatal page errors and treats errors from non-optional resources as fatal page errors. They contain no pod names, timestamps, UUIDs, node names, namespace names, IP addresses, or other run-dependent values.

Full details: Test Structure And Quality

Explanation

PASS — the custom check applies only to Ginkgo test code. This pull request changes a TypeScript React test file using Jest and React Testing Library (describe, it, expect, jest.mock) and changes list-page.tsx; it adds no Ginkgo tests or Ginkgo cluster operations. Therefore the listed Ginkgo-specific requirements are inapplicable.

Full details: Microshift Test Compatibility

Explanation

The pull request adds only frontend TypeScript/React unit tests and changes MultiListPage; it adds no Ginkgo e2e tests. The added tests use Jest describe/it and mock useK8sWatchResources, so the MicroShift API compatibility check does not apply.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

The pull request changes only two frontend TypeScript/TSX files. The added tests use Jest/React Testing Library describe and it, not Ginkgo e2e tests. They mock useK8sWatchResources and do not assume multiple nodes, HA, topology, scheduling, or failover. The SNO compatibility check is therefore not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only the frontend MultiListPage implementation and its unit tests. The diff adds no deployment manifests, operator code, controllers, replicas, affinity, topology spread constraints, node selectors, tolerations, or PDBs. Therefore, it introduces no topology-dependent scheduling constraint covered by this check.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The PR changes only two frontend TypeScript/TSX files: list-page.tsx and its Jest spec. The diff adds MultiListPage error handling and test cases; it does not modify an OTE binary, main(), suite setup, or any process-level stdout path. Searches of added lines found no stdout APIs or OTE entry points.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request adds Jest/React unit tests in list-page.spec.tsx, not new Ginkgo e2e tests. The tests mock useK8sWatchResources and perform no network or external service access. The added code contains no IPv4 addresses, IPv4-only parsing, IPv4 CIDRs, URL host interpolation, or public connectivity requirements.

Full details: No-Weak-Crypto

Explanation

PASS: The PR diff only changes MultiListPage load-error filtering and adds unit tests for optional and required resource errors. No MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, crypto API, custom crypto implementation, or secret/token comparison was introduced.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only two TypeScript/TSX files. The diff adds optional resource error handling and tests, with no container or Kubernetes manifests. Searches of the changed files found none of privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation, and no root security configuration.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The PR adds no logging statements or log sinks. The changed production code only filters loadError entries before passing the value to ListComponent; it does not emit the error. The tests use static forbidden-error strings, including a resource domain, but only capture and assert values and do not log passwords, tokens, API keys, PII, session IDs, hostnames, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Hi @platex-rehor-bot. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[platex-rehor-bot]

/jira refresh

[openshift-ci-robot]

@platex-rehor-bot: This pull request references Jira Issue OCPBUGS-111081, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jhadvig]

/ok-to-test

[jhadvig]

/lgtm
/approve

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console
/test e2e-playwright

[jhadvig]

/retest

[jhadvig]

Hey @platex-rehor-bot 👍

ci/prow/frontend is failing with 1 ESLint error — a Prettier formatting violation in list-page.tsx:

609:25  error  Replace `⏎··········!(r.loadError·instanceof·NoModelError)·&&⏎·········` with `·!(r.loadError·instanceof·NoModelError)·&&`  prettier/prettier

The multi-line formatting in the loadError useMemo doesn't match Prettier's expected output. Running yarn eslint --fix frontend/public/components/factory/list-page.tsx (or just npx prettier --write on the file) should auto-fix it.

Also worth noting: MAX_WARNINGS is currently enforced as an exact count (342), not a ceiling. If this PR doesn't change the warning count, no update needed, but if it does you'll need to adjust MAX_WARNINGS in frontend/package.json to match.

[platex-rehor-bot]

@jhadvig Thanks for the catch! Fixed in 5ca58f2:

• Fixed the Prettier formatting violation in the loadError useMemo (collapsed multi-line condition to single line)
• Reverted MAX_WARNINGS from 343 back to 342 — this PR doesn't change the ESLint warning count

/retest

[jhadvig]

/pipeline required

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console
/test e2e-playwright

[rhamilto]

/lgtm

Playwright test failures caused by auth bugs. We really need to get those PRs merged.

[openshift-merge-bot]

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

[platex-rehor-bot]

Rebased onto latest main to resolve merge conflict (only frontend/package.json MAX_WARNINGS line conflicted — kept upstream's value). Code changes are identical to what was previously reviewed.

The force push removed the lgtm label — could you re-apply when convenient?

cc @jhadvig @rhamilto

[jhadvig]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console
/test e2e-playwright

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhadvig, platex-rehor-bot, rhamilto

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• frontend/OWNERS [jhadvig,rhamilto]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[platex-rehor-bot]

/retest-required

[platex-rehor-bot]

/retest-required

[jhadvig]

/retest

[jhadvig]

/test e2e-playwright

[openshift-ci]

@platex-rehor-bot: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-playwright	5bb3bc8	link	false	/test e2e-playwright

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.