[BUG] Mage does not map workspace roles during migration to 0.9.70.

[cisrudlow]

Mage version

0.9.70

Describe the bug

In version 0.9.69, you introduced a change (#4843). Unfortunately, this caused our environment update process to fail. Here's what happened:

We attempted to migrate from version 0.9.66 to 0.9.70. On our cluster, we have multiple instances of Mage, each designated as PROJECT_TYPE=sub. All of these instances use the same database, as do the workspaces. Unfortunately, role names are not automatically migrated, which results in users losing access to their environments.

We've also encountered several additional issues:

• We tried to create default roles for the project through the page .../settings/workspace/roles by clicking on "Create default roles and permissions". Unfortunately, the process never completes. It appears (confirmed by logs) that Mage enters a loop of executing the same select queries over and over, which also causes the application to become unresponsive.
• When creating a new Mage instance (using a Helm Chart provided by you), default roles for the project (sub-type project) are not created. The API for retrieving them (and thus the UI) does not work as it should. The list is always restricted to a certain number of records.

Here are our environment variables:

• env:
  • name: USER_CODE_PATH
    value: demo2
  • name: MAGE_BASE_PATH
    value: demo2
  • name: PROJECT_UUID
    value: b526683ec8fb61bbdd5865e5fac2605f
  • name: KUBE_NAMESPACE
    valueFrom:
    fieldRef:
    apiVersion: v1
    fieldPath: metadata.namespace
  • name: AWS_REGION_NAME
    value: us-east-1
  • name: MAGE_DATABASE_CONNECTION_URL
    valueFrom:
    secretKeyRef:
    key: *****
    name: ****
  • name: MAGE_EC2_SUBNET_ID
    value: subnet-*****
  • name: REQUIRE_USER_AUTHENTICATION
    value: "1"
  • name: PROJECT_TYPE
    value: sub
  • name: UPDATE_ROLES_ON_LOGIN
    value: "1"
  • name: DEBUG
    value: "1"
  • name: SERVER_VERBOSITY
    value: INFO
  • name: DEFAULT_EXECUTOR_TYPE
    value: k8s
  • name: K8S_SERVICE_ACCOUNT
    value: demo2
  • name: REDIS_URL
    value: redis://mage-redis-headless.mage.svc.cluster.local:6379/0
  • name: INSTANCE_TYPE
    value: web_server
  • name: AWS_STS_REGIONAL_ENDPOINTS
    value: regional
  • name: AWS_DEFAULT_REGION
    value: us-east-1
  • name: AWS_REGION
    value: us-east-1

We would appreciate your guidance on these issues.

To reproduce

No response

Expected behavior

No response

Screenshots

No response

Operating system

No response

Additional context

No response

[mukundjalan]

We are facing similar issue as well

[cisrudlow]

Ok, I "found" the solution to the issue of roles not being created. My assumption was incorrect. Roles are being created, but the API for retrieving them (and thus the UI) does not work as it should. The list is always restricted to a certain number of records.

As a result, there is no way to assign permissions to users because there is no pagination in the UI (as well as in the GET /api/roles API).

However, this does not solve the problem with the Mage upgrade.

[dy46]

@mukundjalan can you describe your issue? any additional information is always appreciated