[BUG] rancher/rancher-webhook:v0.4.6 broken

[daleckystepan]

Rancher Server Setup

• Rancher version: 2.8.4
• Installation option (Docker install/Helm Chart): Docker, RKE2
  • If Helm Chart, Kubernetes Cluster and version (RKE1, RKE2, k3s, EKS, etc):
• Proxy/Cert Details: self-signed

Information about the Cluster

• Kubernetes version: 1.28.10
• Cluster Type (Local/Downstream): 1 Local, 1 Downstream based on vSphere
  • If downstream, what type of cluster? (Custom/Imported or specify provider for Hosted/Infrastructure Provider):

User Information

• What is the role of the user logged in? (Admin/Cluster Owner/Cluster Member/Project Owner/Project Member/Custom)
  • If custom, define the set of permissions: Owner

Describe the bug

rancher/rancher-webhook:v0.4.6 logs

time="2024-06-13T12:49:45Z" level=error msg="failed to get rules from referenced roleTemplate 'project-member': failed to check externalRules feature flag: features.management.cattle.io \"external-rules\" not found"
2024-06-13T12:49:45.048013157Z time="2024-06-13T12:49:45Z" level=error msg="failed to resolve rules from roletemplate 'rt-gfk28': failed to check externalRules feature flag: features.management.cattle.io \"external-rules\" not found"

Adding/removing AD groups, assigning permission don't work. Multiple clusters are affected.

To Reproduce

Update to rancher/rancher-webhook:v0.4.6 in your local cluster

Result

Expected Result

No issues in logs, ActiveDirectory integration works

Screenshots

Additional context

Reverting manually to rancher/rancher-webhook:v0.4.5 fixes the issue

root cause MR: rancher/charts#4074

That would probably also help: https://github.com/rancher/webhook/releases/tag/v0.4.7

[sbjzn]

Also facing this issue, using Azure AD auth.

It also affects local internal auth.

[sbjzn]

I was also put in a glitch state where my restricted user had all privileges, this needs to be fixed ASAP.

[daleckystepan]

rancher/charts#4085

[macedogm]

@daleckystepan and @sbjzn please have a look at this comment #46254 for the fix.

[daleckystepan]

@macedogm Fixed for me. Thank you for quick response.

[sbjzn]

Same here

[macedogm]

To be fixed in release v2.8.5. Closing, as this is fixed per this comment #46254. Feel free to reopen in case something else happens.

[macedogm]

CC @samjustus