User sees shared pipelines in Private section in Central Dashboard while not being a contributor in any namespace

[furiousassault]

/kind bug

What steps did you take and what happened:
[A clear and concise description of what the bug is.]
We have a Kubeflow setup and switched REGISTRATION_FLOW variable to false to disable welcome screen and test manual namespace management.

When user is owning some empty namespace, or added as a contributor to such namespace, it sees no Private pipelines, as expected. But when we remove this user from contributors, so they doesn't have any namespaces, user sees all pipelines from Shared in Private section. User can successfully remove any of these "pipelines".

What did you expect to happen:
It is expected that he doesn't have access to the Dashboard at all, seeing some stub instead.
Or, if the "access without namespace" is valid scenario for work with shared entities, they are not shown in Private (namespaced) section.

Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]
Operations on some other entities might also be affected.

Environment:

• Kubeflow version: 1.8.0
• kfctl version: not used
• Kubernetes platform: GKE
• Kubernetes version: v1.27.10

[andreyvelich]

/transfer dashboard

[google-oss-prow]

@furiousassault: The label(s) kind/bug cannot be applied, because the repository doesn't have them.

In response to this:

/kind bug

What steps did you take and what happened:
[A clear and concise description of what the bug is.]
We have a Kubeflow setup and switched REGISTRATION_FLOW variable to false to disable welcome screen and test manual namespace management.

When user is owning some empty namespace, or added as a contributor to such namespace, it sees no Private pipelines, as expected. But when we remove this user from contributors, so they doesn't have any namespaces, user sees all pipelines from Shared in Private section. User can successfully remove any of these "pipelines".

What did you expect to happen:
It is expected that he doesn't have access to the Dashboard at all, seeing some stub instead.
Or, if the "access without namespace" is valid scenario for work with shared entities, they are not shown in Private (namespaced) section.

Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]
Operations on some other entities might also be affected.

Environment:

• Kubeflow version: 1.8.0
• kfctl version: not used
• Kubernetes platform: GKE
• Kubernetes version: v1.27.10

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[juliusvonkohout]

/lifecyle frozen