db-console: Allow users with MODIFIFYCLUSTERSETTING to view unredacted cluster settings #137698
Labels
branch-master
Failures and bugs on the master branch.
C-bug
Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.
T-observability
#115851 Introduced logic to allow users with
MODIFYCLUSTERSETTING
privilege to view sensitive cluster settings when viewing cluster settings via SQL. This same logic doesn't hold true for the cluster settings page in DB-console and sensitive settings are always redacted, unless the user is an admin. Based on this conversations, DB-console should have the same rules and should allow users withMODIFYCLUSTERSETTING
to be able to view sensitive cluster settings.The reason why db-console doesn't show sensitive cluster setting values is because it implements its own authorization and redaction logic and accesses settings via the settings registry directly, instead of querying the crdb_internal table. Possible solutions:
MODIFYCLUSTERSETTING
to view sensitive settingsslack conversation for some more context: https://cockroachlabs.slack.com/archives/C063CP41TG9/p1734041508464959
Jira issue: CRDB-45709
The text was updated successfully, but these errors were encountered: