[BUG] Cluster member role user should not be able to delete node on Harvester Hosts page on Rancher managed Harvester

[TachunLin]

Describe the bug

When access Harvester v1.3.2 from Rancher virtualization management. (UI extension v1.0.2)

• And create a Rancher standard user project-member

• Set the Cluster Member role

• And set the Project Member role to the default project

• When we login Rancher with project-member user to access Harvester

• On the Hosts page, the Cluster Member role user still can delete the node

  

• Video clip reference

  vokoscreenNG-2024-12-25_18-37-22.mp4

To Reproduce
Steps to reproduce the behavior:

1. Prepare 3 nodes Harvester v1.3.2 cluster
2. Helm install Rancher v2.10.1-alpha1
3. Import Harvester from Rancher virtualization management
4. Create a standard user project-member in Rancher user management page
5. Access Harvester from Rancher virtualization management
6. Open RBAC -> Cluster Members
7. Set the Cluster Member role to project-member
8. Open Project/Namespaces page
9. Edit config of the default project
10. Set the Project Member role to the project-member
11. Logout admin from Rancher
12. Login with project-member user
13. Access Harvester from Rancher
14. Open Hosts page
15. Check the delete button on the node

Expected behavior

From the Cluster Member role description indicate

Members can manage the resources inside the Cluster but not change the Cluster itself

For security concern, cluster member role user should not be able to delete node on Harvester Hosts page.

Support bundle

supportbundle_50777f72-4a54-4f12-bd0f-aee3c949498a_2024-12-25T10-46-44Z.zip

Environment

• Harvester ISO version: v1.3.2
• Underlying Infrastructure: 3 nodes kvm machines
• Rancher version: v2.10.1-alpha1
• Harvester ui extension: v1.0.2

[harvesterhci-io-github-bot]

Pre Ready-For-Testing Checklist

• Where is the reproduce steps/test steps documented?
  The reproduce steps/test steps are at:

Multi-node

• Log in as admin:
  

• Log in as project-member:
  

• Standalone mode (only admin login available):
  

Single-node

• Integration mode:
  

• Standalone mode:
  

• If labeled: area/ui Has the UI issue filed or ready to be merged?
  The UI issue/PR is at: fix: cluster member role user should not be able to delete node on Harvester Hosts page harvester-ui-extension#83

• If NOT labeled: not-require/test-plan Has the e2e test plan been merged? Have QAs agreed on the automation test case? If only test case skeleton w/o implementation, have you created an implementation issue?
  • The automation skeleton PR is at:
  • The automation test case PR is at:

[harvesterhci-io-github-bot]

Automation e2e test issue: harvester/tests#1779