Skip to content

WIP: feat(settings): add admin groups for automatic admin privileges - #8205

Draft
KhizerRehan wants to merge 5 commits into
kubermatic:mainfrom
KhizerRehan:feat/14761-admin-groups
Draft

WIP: feat(settings): add admin groups for automatic admin privileges#8205
KhizerRehan wants to merge 5 commits into
kubermatic:mainfrom
KhizerRehan:feat/14761-admin-groups

Conversation

@KhizerRehan

@KhizerRehan KhizerRehan commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:

This PR adds an Admin Groups setting to the global admin settings so that members of the configured OIDC groups are automatically granted KKP administrator privileges without manual per-user promotion.

Default (Admin Page) New Field (Admin Groups)

image

Existing "administrators" route page

It will show via "label" and hovering will show tooltip that which group make this user an admin

Screenshot 2026-07-23 at 1 56 19 PM

Which issue(s) this PR fixes:

Which issue(s) this PR fixes:
Fixes kubermatic/kubermatic#14761

What type of PR is this?
/kind feature

Special notes for your reviewer:
Needs Backend KKP (SDK) PR to merge and then we need to get merged commmit changes to UI in order to test this PR as SDK changes export new annotation e.g kubermaticv1.AdminGrantedByGroupAnnotation

Does this PR introduce a user-facing change? Then add your Release Note here:

Added Admin Groups setting: members of the configured OIDC groups are automatically granted KKP administrator privileges

Documentation:

TBD

Test issue:

TBD

@KhizerRehan KhizerRehan changed the title feat(settings): add admin groups for automatic admin privileges WIP: feat(settings): add admin groups for automatic admin privileges Jul 23, 2026
@KhizerRehan

KhizerRehan commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

/test all

@kubermatic-bot kubermatic-bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. docs/tbd Denotes a PR that needs documentation (change) that will be done later. test-issue/tbd Denotes a PR that needs a test issue (change) that will be created later. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. do-not-merge/docs-needed Indicates that a PR should not merge because it's missing one of the documentation labels. do-not-merge/test-issue-needed Indicates that a PR should not merge because it's missing one of the test issue labels. and removed release-note Denotes a PR that will be considered when it comes time to generate release notes. test-issue/tbd Denotes a PR that needs a test issue (change) that will be created later. docs/tbd Denotes a PR that needs documentation (change) that will be done later. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. do-not-merge/docs-needed Indicates that a PR should not merge because it's missing one of the documentation labels. do-not-merge/test-issue-needed Indicates that a PR should not merge because it's missing one of the test issue labels. labels Jul 23, 2026
@kubermatic-bot

kubermatic-bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@kubermatic-bot kubermatic-bot added dco-signoff: yes Denotes that all commits in the pull request have the valid DCO signoff message. do-not-merge/test-issue-needed Indicates that a PR should not merge because it's missing one of the test issue labels. do-not-merge/docs-needed Indicates that a PR should not merge because it's missing one of the documentation labels. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. docs/tbd Denotes a PR that needs documentation (change) that will be done later. test-issue/tbd Denotes a PR that needs a test issue (change) that will be created later. and removed test-issue/tbd Denotes a PR that needs a test issue (change) that will be created later. docs/tbd Denotes a PR that needs documentation (change) that will be done later. release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Jul 23, 2026
@kubermatic-bot

kubermatic-bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mohamed-rafraf for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubermatic-bot kubermatic-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed do-not-merge/docs-needed Indicates that a PR should not merge because it's missing one of the documentation labels. do-not-merge/test-issue-needed Indicates that a PR should not merge because it's missing one of the test issue labels. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jul 23, 2026
@KhizerRehan

KhizerRehan commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

/hold till kubermatic/kubermatic#16165 is reviewed/merged. Require latest changes of SDK

Testing Guideline Locally:

PreRequisites:

  • set kubermatic-operator to 0
  • set kubermatic-master to 0
  • run your master controller
  • Make sure authenticate via Vault
  • To go get KKP SDK Changes from branch to specific commit incase needs to test prior to backend PR is merged

Run Master Controller (KKP backend Locally)

  • KUBERMATIC_EDITION=ee ./hack/run-master-controller-manager.sh

API/UI

  • Run UI/API locally

See Changes (Test Guidelines)

  • We Can update any user to CR
  • add any group e.g "test123"
  • Navigate to UI -> Add same group under "Defaults" page -> Admin Group : "test123"

Locally Running Controller

  • Login with e.g Github Account that has OIDC groups but NON-Admin user
  • Should reconcile controller
  • Github User should be be able to Promoted to "Admin" via Same Group Matching and Similarly Demoted in case we remove group Either from
    • User CR groups OR
    • Remove from "Admin Groups" from settings page

@kubermatic-bot kubermatic-bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 23, 2026
@KhizerRehan
feat(settings): add admin groups for automatic admin privileges
f19cd88 
Add adminGroups to global settings: members of the listed OIDC groups
are automatically granted KKP admin. API exposes the field in v1/v2
settings types and admin settings handler; admins granted via a group
carry grantedByGroup and cannot be demoted from the UI, since the
controller would revert the change on the next reconcile.

Dashboard adds adminGroups management to the admin defaults page and
marks group-granted admins in the admins list.

Refs kubermatic/kubermatic#14761
@KhizerRehan
minor lint fixes and small note
9f5a161
@KhizerRehan
fix(update): go sdk version and update comments
3a09981
@KhizerRehan
KhizerRehan force-pushed the feat/14761-admin-groups branch from 83ca43a to 3a09981 Compare August 5, 2026 08:08
@KhizerRehan

KhizerRehan commented Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

/test all

@KhizerRehan

KhizerRehan commented Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

/test all

2 similar comments
@KhizerRehan

KhizerRehan commented Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

/test all

@KhizerRehan

KhizerRehan commented Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

/test all

@KhizerRehan
KhizerRehan force-pushed the feat/14761-admin-groups branch from dceb419 to 92583b9 Compare August 6, 2026 09:16
@KhizerRehan

KhizerRehan commented Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

/test all

@kubermatic-bot

kubermatic-bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

@KhizerRehan: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pre-dashboard-web-check 92583b9 link true /test pre-dashboard-web-check
pre-dashboard-web-integration-tests-ce 92583b9 link true /test pre-dashboard-web-integration-tests-ce
pre-dashboard-web-unit 92583b9 link true /test pre-dashboard-web-unit

Full PR test history

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dco-signoff: yes Denotes that all commits in the pull request have the valid DCO signoff message. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. docs/tbd Denotes a PR that needs documentation (change) that will be done later. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. test-issue/tbd Denotes a PR that needs a test issue (change) that will be created later.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[feature-request] Allow mapping groups to be KKP Administrators

2 participants

@KhizerRehan @kubermatic-bot