"History and Rollback" screen for apps-in-any-namespace app fails to load data

jdoylei commented 9 months ago

Describe the bug

When viewing "History and Rollback", and clicking on an individual deployment in the list, the commit info (author/date/message) is loaded and displayed, but the "Images" section that typically lists the images instead says "Failed to load data, please try again."

Note, this occurs for an apps-in-any-namespace app.

To Reproduce

In the UI, view an Application with apps-in-any-namespace (app namespace besides "argocd")
Click "History and Rollback"
The deployment list is loaded and shown, and the deployment at the top of the list automatically selected
Commit info for that deployment is loaded and shown
"Images" section for that deployment does not appear, instead showing "Failed to load data, please try again."
Error box pops up in the corner with a permissions error like "Unable to load data: permission denied: applications, create, k8s-k8sop-project/argop-test-manifest-2 ..."
Selecting other deployments in the list repeats the behavior

Users with admin privileges (applications create *) observe normal behavior instead, with no error.

Expected behavior

The deployment automatically selected would display the usual "Images" section.
Each deployment selected afterward would also display the usual "Images" section.

Screenshots

Application in non-default namespace:

History and Rollback error:

Version

$ argocd version
argocd: v2.9.3+6eba5be
  BuildDate: 2023-12-01T23:24:09Z
  GitCommit: 6eba5be864b7e031871ed7698f5233336dfe75c7
  GitTreeState: clean
  GoVersion: go1.21.4
  Compiler: gc
  Platform: windows/amd64
argocd-server: v2.9.3+6eba5be
  BuildDate: 2023-12-01T23:05:50Z
  GitCommit: 6eba5be864b7e031871ed7698f5233336dfe75c7
  GitTreeState: clean
  GoVersion: go1.21.3
  Compiler: gc
  Platform: linux/amd64
  Kustomize Version: v5.2.1 2023-10-19T20:13:51Z
  Helm Version: v3.13.2+g2a2fb3b
  Kubectl Version: v0.24.2
  Jsonnet Version: v0.20.0

Logs

Noticed that the commit info seems to come from an API request with an app namespace parameter:

GET https://xxx/api/v1/applications/argop-test-manifest-2/revisions/cd5b33da08a2afab36d1a30b8aaf1b5d9dcf99fe/metadata?appNamespace=argocd-k8sop

While the error seems to come from an API request without an app namespace parameter:

POST https://xxx/api/v1/repositories/....git/appdetails
{"source":{"repoURL":"....git","path":"argop-tests/manifest","targetRevision":"cd5b33da08a2afab36d1a30b8aaf1b5d9dcf99fe","appName":"argop-test-manifest-2"},"appName":"argop-test-manifest-2","appProject":"k8s-k8sop-project"}

I think the permission denied error is coming from the appdetails service here - https://github.com/argoproj/argo-cd/blob/v2.9.3/server/repository/repository.go#L304-L310 - because it expects the UI to pass the app namespace prefixing the app name, and doesn't look for the app in the right app namespace.

jdoylei commented 9 months ago

The symptoms where some UI requests include the app namespace parameter and other requests don't sounds similar to the issue reported in #13675 (app not found when editing resource in UI).

andrii-korotkov-verkada commented 1 day ago

ArgoCD versions 2.10 and below have reached EOL. Can you upgrade and let us know if the issue is still present, please?

jdoylei commented 24 minutes ago

@andrii-korotkov-verkada - Thanks for checking.

We're currently running Argo CD v2.12.3+6b9cd82 and still have this issue:

Unable to load data: permission denied: applications, create, k8s-k8sop-project/argop-addon-policyascode-isone-applications-dev-02-cluster, sub: ..., iat: 2024-11-12T14:13:32Z

argoproj / argo-cd

"History and Rollback" screen for apps-in-any-namespace app fails to load data #16980