Introduce permission check in kubernetes frontend

Signed-off-by: Dominika Zemanovicova <dzemanov@redhat.com>

plugins/kubernetes-cluster/package.json

@@ -47,6 +47,7 @@
     "@backstage/plugin-catalog-react": "workspace:^",
     "@backstage/plugin-kubernetes-common": "workspace:^",
     "@backstage/plugin-kubernetes-react": "workspace:^",
+    "@backstage/plugin-permission-react": "workspace:^",
     "@kubernetes-models/apimachinery": "^2.0.0",
     "@kubernetes-models/base": "^5.0.0",
     "@material-ui/core": "^4.12.2",

plugins/kubernetes-cluster/src/components/KubernetesClusterContent/KubernetesClusterContent.tsx

@@ -24,6 +24,8 @@ import {
   useKubernetesClusterError,
 } from '../KubernetesClusterErrorContext/KubernetesClusterErrorContext';
 import { WarningPanel } from '@backstage/core-components';
+import { useKubernetesClustersPermission } from '../../hooks/useKubernetesClustersPermission';
+import { kubernetesClustersPermission } from '@backstage/plugin-kubernetes-common';
 
 const ContentGrid = () => {
   const { error } = useKubernetesClusterError();
@@ -57,7 +59,15 @@ const ContentGrid = () => {
  * @public
  */
 export const KubernetesClusterContent = () => {
-  return (
+  const hasKubernetesClustersPermission = useKubernetesClustersPermission();
+
+  return !hasKubernetesClustersPermission ? (
+    <WarningPanel
+      title="Permission required"
+      message={`To view Kubernetes objects, contact your administrator to give you the 
+                    '${kubernetesClustersPermission.name}' permission.`}
+    />
+  ) : (
     <KubernetesClusterErrorProvider>
       <ContentGrid />
     </KubernetesClusterErrorProvider>

plugins/kubernetes-cluster/src/hooks/useKubernetesClustersPermission.ts

@@ -0,0 +1,26 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { kubernetesClustersPermission } from '@backstage/plugin-kubernetes-common';
+import { usePermission } from '@backstage/plugin-permission-react';
+
+export const useKubernetesClustersPermission = () => {
+  const kubernetesClustersPermissionResult = usePermission({
+    permission: kubernetesClustersPermission,
+  });
+
+  return kubernetesClustersPermissionResult.allowed;
+};

plugins/kubernetes/package.json

@@ -66,6 +66,7 @@
     "@backstage/plugin-catalog-react": "workspace:^",
     "@backstage/plugin-kubernetes-common": "workspace:^",
     "@backstage/plugin-kubernetes-react": "workspace:^",
+    "@backstage/plugin-permission-react": "workspace:^",
     "@kubernetes-models/apimachinery": "^2.0.0",
     "@kubernetes-models/base": "^5.0.0",
     "@kubernetes/client-node": "1.0.0-rc7",

plugins/kubernetes/src/KubernetesContent.tsx

@@ -28,13 +28,18 @@ import {
 import {
   DetectedError,
   detectErrors,
+  kubernetesClustersPermission,
+  kubernetesResourcesPermission,
 } from '@backstage/plugin-kubernetes-common';
 import {
   Content,
   EmptyState,
   Page,
   Progress,
+  WarningPanel,
 } from '@backstage/core-components';
+import { useKubernetesClustersPermission } from './hooks/useKubernetesClustersPermission';
+import { useKubernetesResourcesPermission } from './hooks/useKubernetesResourcesPermission';
 
 type KubernetesContentProps = {
   entity: Entity;
@@ -46,11 +51,27 @@ export const KubernetesContent = ({
   entity,
   refreshIntervalMs,
 }: KubernetesContentProps) => {
+  const hasKubernetesClustersPermission = useKubernetesClustersPermission();
+  const hasKubernetesResourcesPermission = useKubernetesResourcesPermission();
   const { kubernetesObjects, error } = useKubernetesObjects(
     entity,
     refreshIntervalMs,
   );
 
+  if (!hasKubernetesClustersPermission || !hasKubernetesResourcesPermission) {
+    return (
+      <Page themeId="tool">
+        <Content>
+          <WarningPanel
+            title="Permission required"
+            message={`To view Kubernetes objects, contact your administrator to give you the 
+              '${kubernetesClustersPermission.name}' and '${kubernetesResourcesPermission.name}' permission.`}
+          />
+        </Content>
+      </Page>
+    );
+  }
+
   const clusters = kubernetesObjects?.items.map(item => item.cluster) ?? [];
 
   const clustersWithErrors =

plugins/kubernetes/src/hooks/useKubernetesClustersPermission.ts

@@ -0,0 +1,26 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { kubernetesClustersPermission } from '@backstage/plugin-kubernetes-common';
+import { usePermission } from '@backstage/plugin-permission-react';
+
+export const useKubernetesClustersPermission = () => {
+  const kubernetesClustersPermissionResult = usePermission({
+    permission: kubernetesClustersPermission,
+  });
+
+  return kubernetesClustersPermissionResult.allowed;
+};

plugins/kubernetes/src/hooks/useKubernetesResourcesPermission.ts

@@ -0,0 +1,26 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { kubernetesResourcesPermission } from '@backstage/plugin-kubernetes-common';
+import { usePermission } from '@backstage/plugin-permission-react';
+
+export const useKubernetesResourcesPermission = () => {
+  const kubernetesResourcesPermissionResult = usePermission({
+    permission: kubernetesResourcesPermission,
+  });
+
+  return kubernetesResourcesPermissionResult.allowed;
+};

yarn.lock

@@ -6740,6 +6740,7 @@ __metadata:
     "@backstage/plugin-catalog-react": "workspace:^"
     "@backstage/plugin-kubernetes-common": "workspace:^"
     "@backstage/plugin-kubernetes-react": "workspace:^"
+    "@backstage/plugin-permission-react": "workspace:^"
     "@backstage/test-utils": "workspace:^"
     "@kubernetes-models/apimachinery": ^2.0.0
     "@kubernetes-models/base": ^5.0.0
@@ -6868,6 +6869,7 @@ __metadata:
     "@backstage/plugin-catalog-react": "workspace:^"
     "@backstage/plugin-kubernetes-common": "workspace:^"
     "@backstage/plugin-kubernetes-react": "workspace:^"
+    "@backstage/plugin-permission-react": "workspace:^"
     "@backstage/test-utils": "workspace:^"
     "@kubernetes-models/apimachinery": ^2.0.0
     "@kubernetes-models/base": ^5.0.0