version: bump version to 2.29.1 (#679)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -94,23 +94,8 @@ body:
       description: We only provide support for current versions of Portainer as per the lifecycle policy linked above. If you are on an older version of Portainer we recommend [updating first](https://docs.portainer.io/start/upgrade) in case your bug has already been fixed.
       multiple: false
       options:
-        - '2.31.3'
-        - '2.31.2'
-        - '2.31.1'
-        - '2.31.0'
-        - '2.30.1'
-        - '2.30.0'
-        - '2.29.2'
-        - '2.29.1'
-        - '2.29.0'
         - '2.28.1'
         - '2.28.0'
-        - '2.27.9'
-        - '2.27.8'
-        - '2.27.7'
-        - '2.27.6'
-        - '2.27.5'
-        - '2.27.4'
         - '2.27.3'
         - '2.27.2'
         - '2.27.1'

.golangci.yaml

@@ -12,7 +12,6 @@ linters:
     - copyloopvar
     - intrange
     - perfsprint
-    - ineffassign
 
 linters-settings:
   depguard:

api/archive/zip.go

@@ -2,6 +2,7 @@ package archive
 
 import (
 	"archive/zip"
+	"bytes"
 	"fmt"
 	"io"
 	"os"
@@ -11,6 +12,50 @@ import (
 	"github.com/pkg/errors"
 )
 
+// UnzipArchive will unzip an archive from bytes into the dest destination folder on disk
+func UnzipArchive(archiveData []byte, dest string) error {
+	zipReader, err := zip.NewReader(bytes.NewReader(archiveData), int64(len(archiveData)))
+	if err != nil {
+		return err
+	}
+
+	for _, zipFile := range zipReader.File {
+		err := extractFileFromArchive(zipFile, dest)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func extractFileFromArchive(file *zip.File, dest string) error {
+	f, err := file.Open()
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	data, err := io.ReadAll(f)
+	if err != nil {
+		return err
+	}
+
+	fpath := filepath.Join(dest, file.Name)
+
+	outFile, err := os.OpenFile(fpath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, file.Mode())
+	if err != nil {
+		return err
+	}
+
+	_, err = io.Copy(outFile, bytes.NewReader(data))
+	if err != nil {
+		return err
+	}
+
+	return outFile.Close()
+}
+
 // UnzipFile will decompress a zip archive, moving all files and folders
 // within the zip file (parameter 1) to an output directory (parameter 2).
 func UnzipFile(src string, dest string) error {
@@ -31,11 +76,11 @@ func UnzipFile(src string, dest string) error {
 		if f.FileInfo().IsDir() {
 			// Make Folder
 			os.MkdirAll(p, os.ModePerm)
-
 			continue
 		}
 
-		if err := unzipFile(f, p); err != nil {
+		err = unzipFile(f, p)
+		if err != nil {
 			return err
 		}
 	}
@@ -48,20 +93,20 @@ func unzipFile(f *zip.File, p string) error {
 	if err := os.MkdirAll(filepath.Dir(p), os.ModePerm); err != nil {
 		return errors.Wrapf(err, "unzipFile: can't make a path %s", p)
 	}
-
 	outFile, err := os.OpenFile(p, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode())
 	if err != nil {
 		return errors.Wrapf(err, "unzipFile: can't create file %s", p)
 	}
 	defer outFile.Close()
-
 	rc, err := f.Open()
 	if err != nil {
 		return errors.Wrapf(err, "unzipFile: can't open zip file %s in the archive", f.Name)
 	}
 	defer rc.Close()
 
-	if _, err = io.Copy(outFile, rc); err != nil {
+	_, err = io.Copy(outFile, rc)
+
+	if err != nil {
 		return errors.Wrapf(err, "unzipFile: can't copy an archived file content")
 	}
 

api/cli/cli.go

@@ -61,8 +61,6 @@ func CLIFlags() *portainer.CLIFlags {
 		LogMode:                   kingpin.Flag("log-mode", "Set the logging output mode").Default("PRETTY").Enum("NOCOLOR", "PRETTY", "JSON"),
 		KubectlShellImage:         kingpin.Flag("kubectl-shell-image", "Kubectl shell image").Envar(portainer.KubectlShellImageEnvVar).Default(portainer.DefaultKubectlShellImage).String(),
 		PullLimitCheckDisabled:    kingpin.Flag("pull-limit-check-disabled", "Pull limit check").Envar(portainer.PullLimitCheckDisabledEnvVar).Default(defaultPullLimitCheckDisabled).Bool(),
-		TrustedOrigins:            kingpin.Flag("trusted-origins", "List of trusted origins for CSRF protection. Separate multiple origins with a comma.").Envar(portainer.TrustedOriginsEnvVar).String(),
-		CSP:                       kingpin.Flag("csp", "Content Security Policy (CSP) header").Envar(portainer.CSPEnvVar).Default("true").Bool(),
 	}
 }
 

api/cli/pairlistbool.go

@@ -0,0 +1,45 @@
+package cli
+
+import (
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"gopkg.in/alecthomas/kingpin.v2"
+)
+
+type pairListBool []portainer.Pair
+
+// Set implementation for a list of portainer.Pair
+func (l *pairListBool) Set(value string) error {
+	p := new(portainer.Pair)
+
+	// default to true.  example setting=true is equivalent to setting
+	parts := strings.SplitN(value, "=", 2)
+	if len(parts) != 2 {
+		p.Name = parts[0]
+		p.Value = "true"
+	} else {
+		p.Name = parts[0]
+		p.Value = parts[1]
+	}
+
+	*l = append(*l, *p)
+	return nil
+}
+
+// String implementation for a list of pair
+func (l *pairListBool) String() string {
+	return ""
+}
+
+// IsCumulative implementation for a list of pair
+func (l *pairListBool) IsCumulative() bool {
+	return true
+}
+
+func BoolPairs(s kingpin.Settings) (target *[]portainer.Pair) {
+	target = new([]portainer.Pair)
+	s.SetValue((*pairListBool)(target))
+	return
+}

api/cmd/portainer/log.go

@@ -1,4 +1,4 @@
-package logs
+package main
 
 import (
 	"fmt"
@@ -10,7 +10,7 @@ import (
 	"github.com/rs/zerolog/pkgerrors"
 )
 
-func ConfigureLogger() {
+func configureLogger() {
 	zerolog.ErrorStackFieldName = "stack_trace"
 	zerolog.ErrorStackMarshaler = pkgerrors.MarshalStack
 	zerolog.TimeFieldFormat = zerolog.TimeFormatUnix
@@ -21,7 +21,7 @@ func ConfigureLogger() {
 	log.Logger = log.Logger.With().Caller().Stack().Logger()
 }
 
-func SetLoggingLevel(level string) {
+func setLoggingLevel(level string) {
 	switch level {
 	case "ERROR":
 		zerolog.SetGlobalLevel(zerolog.ErrorLevel)
@@ -34,7 +34,7 @@ func SetLoggingLevel(level string) {
 	}
 }
 
-func SetLoggingMode(mode string) {
+func setLoggingMode(mode string) {
 	switch mode {
 	case "PRETTY":
 		log.Logger = log.Output(zerolog.ConsoleWriter{

api/cmd/portainer/main.go

@@ -39,7 +39,6 @@ import (
 	"github.com/portainer/portainer/api/kubernetes"
 	kubecli "github.com/portainer/portainer/api/kubernetes/cli"
 	"github.com/portainer/portainer/api/ldap"
-	"github.com/portainer/portainer/api/logs"
 	"github.com/portainer/portainer/api/oauth"
 	"github.com/portainer/portainer/api/pendingactions"
 	"github.com/portainer/portainer/api/pendingactions/actions"
@@ -52,7 +51,6 @@ import (
 	"github.com/portainer/portainer/pkg/libhelm"
 	libhelmtypes "github.com/portainer/portainer/pkg/libhelm/types"
 	"github.com/portainer/portainer/pkg/libstack/compose"
-	"github.com/portainer/portainer/pkg/validate"
 
 	"github.com/gofrs/uuid"
 	"github.com/rs/zerolog/log"
@@ -168,8 +166,8 @@ func checkDBSchemaServerVersionMatch(dbStore dataservices.DataStore, serverVersi
 	return v.SchemaVersion == serverVersion && v.Edition == serverEdition
 }
 
-func initKubernetesDeployer(kubernetesTokenCacheManager *kubeproxy.TokenCacheManager, kubernetesClientFactory *kubecli.ClientFactory, dataStore dataservices.DataStore, reverseTunnelService portainer.ReverseTunnelService, signatureService portainer.DigitalSignatureService, proxyManager *proxy.Manager) portainer.KubernetesDeployer {
-	return exec.NewKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager)
+func initKubernetesDeployer(kubernetesTokenCacheManager *kubeproxy.TokenCacheManager, kubernetesClientFactory *kubecli.ClientFactory, dataStore dataservices.DataStore, reverseTunnelService portainer.ReverseTunnelService, signatureService portainer.DigitalSignatureService, proxyManager *proxy.Manager, assetsPath string) portainer.KubernetesDeployer {
+	return exec.NewKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager, assetsPath)
 }
 
 func initHelmPackageManager() (libhelmtypes.HelmPackageManager, error) {
@@ -331,18 +329,6 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		featureflags.Parse(*flags.FeatureFlags, portainer.SupportedFeatureFlags)
 	}
 
-	trustedOrigins := []string{}
-	if *flags.TrustedOrigins != "" {
-		// validate if the trusted origins are valid urls
-		for _, origin := range strings.Split(*flags.TrustedOrigins, ",") {
-			if !validate.IsTrustedOrigin(origin) {
-				log.Fatal().Str("trusted_origin", origin).Msg("invalid url for trusted origin. Please check the trusted origins flag.")
-			}
-
-			trustedOrigins = append(trustedOrigins, origin)
-		}
-	}
-
 	fileService := initFileService(*flags.Data)
 	encryptionKey := loadEncryptionSecretKey(*flags.SecretKeyName)
 	if encryptionKey == nil {
@@ -383,8 +369,7 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 
 	gitService := git.NewService(shutdownCtx)
 
-	// Setting insecureSkipVerify to true to preserve the old behaviour.
-	openAMTService := openamt.NewService(true)
+	openAMTService := openamt.NewService()
 
 	cryptoService := &crypto.Service{}
 
@@ -437,7 +422,7 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		log.Fatal().Err(err).Msg("failed initializing swarm stack manager")
 	}
 
-	kubernetesDeployer := initKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager)
+	kubernetesDeployer := initKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager, *flags.Assets)
 
 	pendingActionsService := pendingactions.NewService(dataStore, kubernetesClientFactory)
 	pendingActionsService.RegisterHandler(actions.CleanNAPWithOverridePolicies, handlers.NewHandlerCleanNAPWithOverridePolicies(authorizationService, dataStore))
@@ -559,7 +544,6 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		Status:                      applicationStatus,
 		BindAddress:                 *flags.Addr,
 		BindAddressHTTPS:            *flags.AddrHTTPS,
-		CSP:                         *flags.CSP,
 		HTTPEnabled:                 sslDBSettings.HTTPEnabled,
 		AssetsPath:                  *flags.Assets,
 		DataStore:                   dataStore,
@@ -593,18 +577,17 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		PendingActionsService:       pendingActionsService,
 		PlatformService:             platformService,
 		PullLimitCheckDisabled:      *flags.PullLimitCheckDisabled,
-		TrustedOrigins:              trustedOrigins,
 	}
 }
 
 func main() {
-	logs.ConfigureLogger()
-	logs.SetLoggingMode("PRETTY")
+	configureLogger()
+	setLoggingMode("PRETTY")
 
 	flags := initCLI()
 
-	logs.SetLoggingLevel(*flags.LogLevel)
-	logs.SetLoggingMode(*flags.LogMode)
+	setLoggingLevel(*flags.LogLevel)
+	setLoggingMode(*flags.LogMode)
 
 	for {
 		server := buildServer(flags)

api/database/boltdb/db.go

@@ -138,8 +138,6 @@ func (connection *DbConnection) Open() error {
 	db, err := bolt.Open(databasePath, 0600, &bolt.Options{
 		Timeout:         1 * time.Second,
 		InitialMmapSize: connection.InitialMmapSize,
-		FreelistType:    bolt.FreelistMapType,
-		NoFreelistSync:  true,
 	})
 	if err != nil {
 		return err

api/dataservices/base.go

@@ -10,7 +10,7 @@ type BaseCRUD[T any, I constraints.Integer] interface {
 	Create(element *T) error
 	Read(ID I) (*T, error)
 	Exists(ID I) (bool, error)
-	ReadAll(predicates ...func(T) bool) ([]T, error)
+	ReadAll() ([]T, error)
 	Update(ID I, element *T) error
 	Delete(ID I) error
 }
@@ -56,13 +56,12 @@ func (service BaseDataService[T, I]) Exists(ID I) (bool, error) {
 	return exists, err
 }
 
-// ReadAll retrieves all the elements that satisfy all the provided predicates.
-func (service BaseDataService[T, I]) ReadAll(predicates ...func(T) bool) ([]T, error) {
+func (service BaseDataService[T, I]) ReadAll() ([]T, error) {
 	var collection = make([]T, 0)
 
 	return collection, service.Connection.ViewTx(func(tx portainer.Transaction) error {
 		var err error
-		collection, err = service.Tx(tx).ReadAll(predicates...)
+		collection, err = service.Tx(tx).ReadAll()
 
 		return err
 	})

api/dataservices/base_test.go

@@ -1,92 +0,0 @@
-package dataservices
-
-import (
-	"strconv"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/slicesx"
-
-	"github.com/stretchr/testify/require"
-)
-
-type testObject struct {
-	ID    int
-	Value int
-}
-
-type mockConnection struct {
-	store map[int]testObject
-
-	portainer.Connection
-}
-
-func (m mockConnection) UpdateObject(bucket string, key []byte, value interface{}) error {
-	obj := value.(*testObject)
-
-	m.store[obj.ID] = *obj
-
-	return nil
-}
-
-func (m mockConnection) GetAll(bucketName string, obj any, appendFn func(o any) (any, error)) error {
-	for _, v := range m.store {
-		if _, err := appendFn(&v); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (m mockConnection) UpdateTx(fn func(portainer.Transaction) error) error {
-	return fn(m)
-}
-
-func (m mockConnection) ViewTx(fn func(portainer.Transaction) error) error {
-	return fn(m)
-}
-
-func (m mockConnection) ConvertToKey(v int) []byte {
-	return []byte(strconv.Itoa(v))
-}
-
-func TestReadAll(t *testing.T) {
-	service := BaseDataService[testObject, int]{
-		Bucket:     "testBucket",
-		Connection: mockConnection{store: make(map[int]testObject)},
-	}
-
-	data := []testObject{
-		{ID: 1, Value: 1},
-		{ID: 2, Value: 2},
-		{ID: 3, Value: 3},
-		{ID: 4, Value: 4},
-		{ID: 5, Value: 5},
-	}
-
-	for _, item := range data {
-		err := service.Update(item.ID, &item)
-		require.NoError(t, err)
-	}
-
-	// ReadAll without predicates
-	result, err := service.ReadAll()
-	require.NoError(t, err)
-
-	expected := append([]testObject{}, data...)
-
-	require.ElementsMatch(t, expected, result)
-
-	// ReadAll with predicates
-	hasLowID := func(obj testObject) bool { return obj.ID < 3 }
-	isEven := func(obj testObject) bool { return obj.Value%2 == 0 }
-
-	result, err = service.ReadAll(hasLowID, isEven)
-	require.NoError(t, err)
-
-	expected = slicesx.Filter(expected, hasLowID)
-	expected = slicesx.Filter(expected, isEven)
-
-	require.ElementsMatch(t, expected, result)
-}

api/dataservices/base_tx.go

@@ -34,32 +34,13 @@ func (service BaseDataServiceTx[T, I]) Exists(ID I) (bool, error) {
 	return service.Tx.KeyExists(service.Bucket, identifier)
 }
 
-// ReadAll retrieves all the elements that satisfy all the provided predicates.
-func (service BaseDataServiceTx[T, I]) ReadAll(predicates ...func(T) bool) ([]T, error) {
+func (service BaseDataServiceTx[T, I]) ReadAll() ([]T, error) {
 	var collection = make([]T, 0)
 
-	if len(predicates) == 0 {
-		return collection, service.Tx.GetAll(
-			service.Bucket,
-			new(T),
-			AppendFn(&collection),
-		)
-	}
-
-	filterFn := func(element T) bool {
-		for _, p := range predicates {
-			if !p(element) {
-				return false
-			}
-		}
-
-		return true
-	}
-
 	return collection, service.Tx.GetAll(
 		service.Bucket,
 		new(T),
-		FilterFn(&collection, filterFn),
+		AppendFn(&collection),
 	)
 }
 

api/dataservices/edgestackstatus/edgestackstatus.go

@@ -1,89 +0,0 @@
-package edgestackstatus
-
-import (
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-)
-
-var _ dataservices.EdgeStackStatusService = &Service{}
-
-const BucketName = "edge_stack_status"
-
-type Service struct {
-	conn portainer.Connection
-}
-
-func (service *Service) BucketName() string {
-	return BucketName
-}
-
-func NewService(connection portainer.Connection) (*Service, error) {
-	if err := connection.SetServiceName(BucketName); err != nil {
-		return nil, err
-	}
-
-	return &Service{conn: connection}, nil
-}
-
-func (s *Service) Tx(tx portainer.Transaction) ServiceTx {
-	return ServiceTx{
-		service: s,
-		tx:      tx,
-	}
-}
-
-func (s *Service) Create(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error {
-	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).Create(edgeStackID, endpointID, status)
-	})
-}
-
-func (s *Service) Read(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) (*portainer.EdgeStackStatusForEnv, error) {
-	var element *portainer.EdgeStackStatusForEnv
-
-	return element, s.conn.ViewTx(func(tx portainer.Transaction) error {
-		var err error
-		element, err = s.Tx(tx).Read(edgeStackID, endpointID)
-
-		return err
-	})
-}
-
-func (s *Service) ReadAll(edgeStackID portainer.EdgeStackID) ([]portainer.EdgeStackStatusForEnv, error) {
-	var collection = make([]portainer.EdgeStackStatusForEnv, 0)
-
-	return collection, s.conn.ViewTx(func(tx portainer.Transaction) error {
-		var err error
-		collection, err = s.Tx(tx).ReadAll(edgeStackID)
-
-		return err
-	})
-}
-
-func (s *Service) Update(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error {
-	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).Update(edgeStackID, endpointID, status)
-	})
-}
-
-func (s *Service) Delete(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) error {
-	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).Delete(edgeStackID, endpointID)
-	})
-}
-
-func (s *Service) DeleteAll(edgeStackID portainer.EdgeStackID) error {
-	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).DeleteAll(edgeStackID)
-	})
-}
-
-func (s *Service) Clear(edgeStackID portainer.EdgeStackID, relatedEnvironmentsIDs []portainer.EndpointID) error {
-	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).Clear(edgeStackID, relatedEnvironmentsIDs)
-	})
-}
-
-func (s *Service) key(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) []byte {
-	return append(s.conn.ConvertToKey(int(edgeStackID)), s.conn.ConvertToKey(int(endpointID))...)
-}

api/dataservices/edgestackstatus/tx.go

@@ -1,95 +0,0 @@
-package edgestackstatus
-
-import (
-	"fmt"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-)
-
-var _ dataservices.EdgeStackStatusService = &Service{}
-
-type ServiceTx struct {
-	service *Service
-	tx      portainer.Transaction
-}
-
-func (service ServiceTx) Create(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error {
-	identifier := service.service.key(edgeStackID, endpointID)
-	return service.tx.CreateObjectWithStringId(BucketName, identifier, status)
-}
-
-func (s ServiceTx) Read(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) (*portainer.EdgeStackStatusForEnv, error) {
-	var status portainer.EdgeStackStatusForEnv
-	identifier := s.service.key(edgeStackID, endpointID)
-
-	if err := s.tx.GetObject(BucketName, identifier, &status); err != nil {
-		return nil, err
-	}
-
-	return &status, nil
-}
-
-func (s ServiceTx) ReadAll(edgeStackID portainer.EdgeStackID) ([]portainer.EdgeStackStatusForEnv, error) {
-	keyPrefix := s.service.conn.ConvertToKey(int(edgeStackID))
-
-	statuses := make([]portainer.EdgeStackStatusForEnv, 0)
-
-	if err := s.tx.GetAllWithKeyPrefix(BucketName, keyPrefix, &portainer.EdgeStackStatusForEnv{}, dataservices.AppendFn(&statuses)); err != nil {
-		return nil, fmt.Errorf("unable to retrieve EdgeStackStatus for EdgeStack %d: %w", edgeStackID, err)
-	}
-
-	return statuses, nil
-}
-
-func (s ServiceTx) Update(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error {
-	identifier := s.service.key(edgeStackID, endpointID)
-	return s.tx.UpdateObject(BucketName, identifier, status)
-}
-
-func (s ServiceTx) Delete(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) error {
-	identifier := s.service.key(edgeStackID, endpointID)
-	return s.tx.DeleteObject(BucketName, identifier)
-}
-
-func (s ServiceTx) DeleteAll(edgeStackID portainer.EdgeStackID) error {
-	keyPrefix := s.service.conn.ConvertToKey(int(edgeStackID))
-
-	statuses := make([]portainer.EdgeStackStatusForEnv, 0)
-
-	if err := s.tx.GetAllWithKeyPrefix(BucketName, keyPrefix, &portainer.EdgeStackStatusForEnv{}, dataservices.AppendFn(&statuses)); err != nil {
-		return fmt.Errorf("unable to retrieve EdgeStackStatus for EdgeStack %d: %w", edgeStackID, err)
-	}
-
-	for _, status := range statuses {
-		if err := s.tx.DeleteObject(BucketName, s.service.key(edgeStackID, status.EndpointID)); err != nil {
-			return fmt.Errorf("unable to delete EdgeStackStatus for EdgeStack %d and Endpoint %d: %w", edgeStackID, status.EndpointID, err)
-		}
-	}
-
-	return nil
-}
-
-func (s ServiceTx) Clear(edgeStackID portainer.EdgeStackID, relatedEnvironmentsIDs []portainer.EndpointID) error {
-	for _, envID := range relatedEnvironmentsIDs {
-		existingStatus, err := s.Read(edgeStackID, envID)
-		if err != nil && !dataservices.IsErrObjectNotFound(err) {
-			return fmt.Errorf("unable to retrieve status for environment %d: %w", envID, err)
-		}
-
-		var deploymentInfo portainer.StackDeploymentInfo
-		if existingStatus != nil {
-			deploymentInfo = existingStatus.DeploymentInfo
-		}
-
-		if err := s.Update(edgeStackID, envID, &portainer.EdgeStackStatusForEnv{
-			EndpointID:     envID,
-			Status:         []portainer.EdgeStackDeploymentStatus{},
-			DeploymentInfo: deploymentInfo,
-		}); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}

api/dataservices/endpointrelation/endpointrelation.go

@@ -112,13 +112,13 @@ func (service *Service) UpdateEndpointRelation(endpointID portainer.EndpointID,
 }
 
 func (service *Service) AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error {
-	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
+	return service.connection.ViewTx(func(tx portainer.Transaction) error {
 		return service.Tx(tx).AddEndpointRelationsForEdgeStack(endpointIDs, edgeStackID)
 	})
 }
 
 func (service *Service) RemoveEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error {
-	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
+	return service.connection.ViewTx(func(tx portainer.Transaction) error {
 		return service.Tx(tx).RemoveEndpointRelationsForEdgeStack(endpointIDs, edgeStackID)
 	})
 }

api/dataservices/interface.go

@@ -12,7 +12,6 @@ type (
 		EdgeGroup() EdgeGroupService
 		EdgeJob() EdgeJobService
 		EdgeStack() EdgeStackService
-		EdgeStackStatus() EdgeStackStatusService
 		Endpoint() EndpointService
 		EndpointGroup() EndpointGroupService
 		EndpointRelation() EndpointRelationService
@@ -40,8 +39,8 @@ type (
 		Open() (newStore bool, err error)
 		Init() error
 		Close() error
-		UpdateTx(func(tx DataStoreTx) error) error
-		ViewTx(func(tx DataStoreTx) error) error
+		UpdateTx(func(DataStoreTx) error) error
+		ViewTx(func(DataStoreTx) error) error
 		MigrateData() error
 		Rollback(force bool) error
 		CheckCurrentEdition() error
@@ -90,16 +89,6 @@ type (
 		BucketName() string
 	}
 
-	EdgeStackStatusService interface {
-		Create(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error
-		Read(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) (*portainer.EdgeStackStatusForEnv, error)
-		ReadAll(edgeStackID portainer.EdgeStackID) ([]portainer.EdgeStackStatusForEnv, error)
-		Update(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error
-		Delete(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) error
-		DeleteAll(edgeStackID portainer.EdgeStackID) error
-		Clear(edgeStackID portainer.EdgeStackID, relatedEnvironmentsIDs []portainer.EndpointID) error
-	}
-
 	// EndpointService represents a service for managing environment(endpoint) data
 	EndpointService interface {
 		Endpoint(ID portainer.EndpointID) (*portainer.Endpoint, error)

api/dataservices/snapshot/snapshot.go

@@ -51,20 +51,3 @@ func (service *Service) ReadWithoutSnapshotRaw(ID portainer.EndpointID) (*portai
 
 	return snapshot, err
 }
-
-func (service *Service) ReadRawMessage(ID portainer.EndpointID) (*portainer.SnapshotRawMessage, error) {
-	var snapshot *portainer.SnapshotRawMessage
-
-	err := service.Connection.ViewTx(func(tx portainer.Transaction) error {
-		var err error
-		snapshot, err = service.Tx(tx).ReadRawMessage(ID)
-
-		return err
-	})
-
-	return snapshot, err
-}
-
-func (service *Service) CreateRawMessage(snapshot *portainer.SnapshotRawMessage) error {
-	return service.Connection.CreateObjectWithId(BucketName, int(snapshot.EndpointID), snapshot)
-}

api/dataservices/snapshot/tx.go

@@ -35,19 +35,3 @@ func (service ServiceTx) ReadWithoutSnapshotRaw(ID portainer.EndpointID) (*porta
 
 	return &snapshot.Snapshot, nil
 }
-
-func (service ServiceTx) ReadRawMessage(ID portainer.EndpointID) (*portainer.SnapshotRawMessage, error) {
-	var snapshot = portainer.SnapshotRawMessage{}
-
-	identifier := service.Connection.ConvertToKey(int(ID))
-
-	if err := service.Tx.GetObject(service.Bucket, identifier, &snapshot); err != nil {
-		return nil, err
-	}
-
-	return &snapshot, nil
-}
-
-func (service ServiceTx) CreateRawMessage(snapshot *portainer.SnapshotRawMessage) error {
-	return service.Tx.CreateObjectWithId(BucketName, int(snapshot.EndpointID), snapshot)
-}

api/datastore/migrate_data.go

@@ -40,11 +40,13 @@ func (store *Store) MigrateData() error {
 	}
 
 	// before we alter anything in the DB, create a backup
-	if _, err := store.Backup(""); err != nil {
+	_, err = store.Backup("")
+	if err != nil {
 		return errors.Wrap(err, "while backing up database")
 	}
 
-	if err := store.FailSafeMigrate(migrator, version); err != nil {
+	err = store.FailSafeMigrate(migrator, version)
+	if err != nil {
 		err = errors.Wrap(err, "failed to migrate database")
 
 		log.Warn().Err(err).Msg("migration failed, restoring database to previous version")
@@ -83,7 +85,6 @@ func (store *Store) newMigratorParameters(version *models.Version, flags *portai
 		DockerhubService:        store.DockerHubService,
 		AuthorizationService:    authorization.NewService(store),
 		EdgeStackService:        store.EdgeStackService,
-		EdgeStackStatusService:  store.EdgeStackStatusService,
 		EdgeJobService:          store.EdgeJobService,
 		TunnelServerService:     store.TunnelServerService,
 		PendingActionsService:   store.PendingActionsService,
@@ -139,7 +140,8 @@ func (store *Store) connectionRollback(force bool) error {
 		}
 	}
 
-	if err := store.Restore(); err != nil {
+	err := store.Restore()
+	if err != nil {
 		return err
 	}
 

api/datastore/migrator/migrate_2_31_0.go

@@ -1,31 +0,0 @@
-package migrator
-
-import portainer "github.com/portainer/portainer/api"
-
-func (m *Migrator) migrateEdgeStacksStatuses_2_31_0() error {
-	edgeStacks, err := m.edgeStackService.EdgeStacks()
-	if err != nil {
-		return err
-	}
-
-	for _, edgeStack := range edgeStacks {
-		for envID, status := range edgeStack.Status {
-			if err := m.edgeStackStatusService.Create(edgeStack.ID, envID, &portainer.EdgeStackStatusForEnv{
-				EndpointID:       envID,
-				Status:           status.Status,
-				DeploymentInfo:   status.DeploymentInfo,
-				ReadyRePullImage: status.ReadyRePullImage,
-			}); err != nil {
-				return err
-			}
-		}
-
-		edgeStack.Status = nil
-
-		if err := m.edgeStackService.UpdateEdgeStack(edgeStack.ID, &edgeStack); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}

api/datastore/migrator/migrate_2_32_0.go

@@ -1,33 +0,0 @@
-package migrator
-
-import (
-	"github.com/pkg/errors"
-	portainer "github.com/portainer/portainer/api"
-	perrors "github.com/portainer/portainer/api/dataservices/errors"
-	"github.com/portainer/portainer/api/internal/endpointutils"
-)
-
-func (m *Migrator) addEndpointRelationForEdgeAgents_2_32_0() error {
-	endpoints, err := m.endpointService.Endpoints()
-	if err != nil {
-		return err
-	}
-
-	for _, endpoint := range endpoints {
-		if endpointutils.IsEdgeEndpoint(&endpoint) {
-			_, err := m.endpointRelationService.EndpointRelation(endpoint.ID)
-			if err != nil && errors.Is(err, perrors.ErrObjectNotFound) {
-				relation := &portainer.EndpointRelation{
-					EndpointID: endpoint.ID,
-					EdgeStacks: make(map[portainer.EdgeStackID]bool),
-				}
-
-				if err := m.endpointRelationService.Create(relation); err != nil {
-					return err
-				}
-			}
-		}
-	}
-
-	return nil
-}

api/datastore/migrator/migrate_dbversion20.go

@@ -18,7 +18,8 @@ func (m *Migrator) updateResourceControlsToDBVersion22() error {
 	for _, resourceControl := range legacyResourceControls {
 		resourceControl.AdministratorsOnly = false
 
-		if err := m.resourceControlService.Update(resourceControl.ID, &resourceControl); err != nil {
+		err := m.resourceControlService.Update(resourceControl.ID, &resourceControl)
+		if err != nil {
 			return err
 		}
 	}
@@ -41,8 +42,8 @@ func (m *Migrator) updateUsersAndRolesToDBVersion22() error {
 
 	for _, user := range legacyUsers {
 		user.PortainerAuthorizations = authorization.DefaultPortainerAuthorizations()
-
-		if err := m.userService.Update(user.ID, &user); err != nil {
+		err = m.userService.Update(user.ID, &user)
+		if err != nil {
 			return err
 		}
 	}
@@ -51,47 +52,38 @@ func (m *Migrator) updateUsersAndRolesToDBVersion22() error {
 	if err != nil {
 		return err
 	}
-
 	endpointAdministratorRole.Priority = 1
 	endpointAdministratorRole.Authorizations = authorization.DefaultEndpointAuthorizationsForEndpointAdministratorRole()
 
-	if err := m.roleService.Update(endpointAdministratorRole.ID, endpointAdministratorRole); err != nil {
-		return err
-	}
+	err = m.roleService.Update(endpointAdministratorRole.ID, endpointAdministratorRole)
 
 	helpDeskRole, err := m.roleService.Read(portainer.RoleID(2))
 	if err != nil {
 		return err
 	}
-
 	helpDeskRole.Priority = 2
 	helpDeskRole.Authorizations = authorization.DefaultEndpointAuthorizationsForHelpDeskRole(settings.AllowVolumeBrowserForRegularUsers)
 
-	if err := m.roleService.Update(helpDeskRole.ID, helpDeskRole); err != nil {
-		return err
-	}
+	err = m.roleService.Update(helpDeskRole.ID, helpDeskRole)
 
 	standardUserRole, err := m.roleService.Read(portainer.RoleID(3))
 	if err != nil {
 		return err
 	}
-
 	standardUserRole.Priority = 3
 	standardUserRole.Authorizations = authorization.DefaultEndpointAuthorizationsForStandardUserRole(settings.AllowVolumeBrowserForRegularUsers)
 
-	if err := m.roleService.Update(standardUserRole.ID, standardUserRole); err != nil {
-		return err
-	}
+	err = m.roleService.Update(standardUserRole.ID, standardUserRole)
 
 	readOnlyUserRole, err := m.roleService.Read(portainer.RoleID(4))
 	if err != nil {
 		return err
 	}
-
 	readOnlyUserRole.Priority = 4
 	readOnlyUserRole.Authorizations = authorization.DefaultEndpointAuthorizationsForReadOnlyUserRole(settings.AllowVolumeBrowserForRegularUsers)
 
-	if err := m.roleService.Update(readOnlyUserRole.ID, readOnlyUserRole); err != nil {
+	err = m.roleService.Update(readOnlyUserRole.ID, readOnlyUserRole)
+	if err != nil {
 		return err
 	}
 

api/datastore/migrator/migrator.go

@@ -3,12 +3,12 @@ package migrator
 import (
 	"errors"
 
+	"github.com/Masterminds/semver"
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/database/models"
 	"github.com/portainer/portainer/api/dataservices/dockerhub"
 	"github.com/portainer/portainer/api/dataservices/edgejob"
 	"github.com/portainer/portainer/api/dataservices/edgestack"
-	"github.com/portainer/portainer/api/dataservices/edgestackstatus"
 	"github.com/portainer/portainer/api/dataservices/endpoint"
 	"github.com/portainer/portainer/api/dataservices/endpointgroup"
 	"github.com/portainer/portainer/api/dataservices/endpointrelation"
@@ -27,8 +27,6 @@ import (
 	"github.com/portainer/portainer/api/dataservices/user"
 	"github.com/portainer/portainer/api/dataservices/version"
 	"github.com/portainer/portainer/api/internal/authorization"
-
-	"github.com/Masterminds/semver"
 	"github.com/rs/zerolog/log"
 )
 
@@ -58,7 +56,6 @@ type (
 		authorizationService    *authorization.Service
 		dockerhubService        *dockerhub.Service
 		edgeStackService        *edgestack.Service
-		edgeStackStatusService  *edgestackstatus.Service
 		edgeJobService          *edgejob.Service
 		TunnelServerService     *tunnelserver.Service
 		pendingActionsService   *pendingactions.Service
@@ -87,7 +84,6 @@ type (
 		AuthorizationService    *authorization.Service
 		DockerhubService        *dockerhub.Service
 		EdgeStackService        *edgestack.Service
-		EdgeStackStatusService  *edgestackstatus.Service
 		EdgeJobService          *edgejob.Service
 		TunnelServerService     *tunnelserver.Service
 		PendingActionsService   *pendingactions.Service
@@ -118,7 +114,6 @@ func NewMigrator(parameters *MigratorParameters) *Migrator {
 		authorizationService:    parameters.AuthorizationService,
 		dockerhubService:        parameters.DockerhubService,
 		edgeStackService:        parameters.EdgeStackService,
-		edgeStackStatusService:  parameters.EdgeStackStatusService,
 		edgeJobService:          parameters.EdgeJobService,
 		TunnelServerService:     parameters.TunnelServerService,
 		pendingActionsService:   parameters.PendingActionsService,
@@ -247,10 +242,6 @@ func (m *Migrator) initMigrations() {
 		m.migratePendingActionsDataForDB130,
 	)
 
-	m.addMigrations("2.31.0", m.migrateEdgeStacksStatuses_2_31_0)
-
-	m.addMigrations("2.32.0", m.addEndpointRelationForEdgeAgents_2_32_0)
-
 	// Add new migrations above...
 	// One function per migration, each versions migration funcs in the same file.
 }

api/datastore/services.go

@@ -13,7 +13,6 @@ import (
 	"github.com/portainer/portainer/api/dataservices/edgegroup"
 	"github.com/portainer/portainer/api/dataservices/edgejob"
 	"github.com/portainer/portainer/api/dataservices/edgestack"
-	"github.com/portainer/portainer/api/dataservices/edgestackstatus"
 	"github.com/portainer/portainer/api/dataservices/endpoint"
 	"github.com/portainer/portainer/api/dataservices/endpointgroup"
 	"github.com/portainer/portainer/api/dataservices/endpointrelation"
@@ -40,8 +39,6 @@ import (
 	"github.com/segmentio/encoding/json"
 )
 
-var _ dataservices.DataStore = &Store{}
-
 // Store defines the implementation of portainer.DataStore using
 // BoltDB as the storage system.
 type Store struct {
@@ -54,7 +51,6 @@ type Store struct {
 	EdgeGroupService          *edgegroup.Service
 	EdgeJobService            *edgejob.Service
 	EdgeStackService          *edgestack.Service
-	EdgeStackStatusService    *edgestackstatus.Service
 	EndpointGroupService      *endpointgroup.Service
 	EndpointService           *endpoint.Service
 	EndpointRelationService   *endpointrelation.Service
@@ -113,12 +109,6 @@ func (store *Store) initServices() error {
 	store.EdgeStackService = edgeStackService
 	endpointRelationService.RegisterUpdateStackFunction(edgeStackService.UpdateEdgeStackFunc, edgeStackService.UpdateEdgeStackFuncTx)
 
-	edgeStackStatusService, err := edgestackstatus.NewService(store.connection)
-	if err != nil {
-		return err
-	}
-	store.EdgeStackStatusService = edgeStackStatusService
-
 	edgeGroupService, err := edgegroup.NewService(store.connection)
 	if err != nil {
 		return err
@@ -279,10 +269,6 @@ func (store *Store) EdgeStack() dataservices.EdgeStackService {
 	return store.EdgeStackService
 }
 
-func (store *Store) EdgeStackStatus() dataservices.EdgeStackStatusService {
-	return store.EdgeStackStatusService
-}
-
 // Environment(Endpoint) gives access to the Environment(Endpoint) data management layer
 func (store *Store) Endpoint() dataservices.EndpointService {
 	return store.EndpointService

api/datastore/services_tx.go

@@ -32,10 +32,6 @@ func (tx *StoreTx) EdgeStack() dataservices.EdgeStackService {
 	return tx.store.EdgeStackService.Tx(tx.tx)
 }
 
-func (tx *StoreTx) EdgeStackStatus() dataservices.EdgeStackStatusService {
-	return tx.store.EdgeStackStatusService.Tx(tx.tx)
-}
-
 func (tx *StoreTx) Endpoint() dataservices.EndpointService {
 	return tx.store.EndpointService.Tx(tx.tx)
 }

api/datastore/test_data/output_24_to_latest.json

@@ -8,7 +8,6 @@
     }
   ],
   "edge_stack": null,
-  "edge_stack_status": null,
   "edgegroups": null,
   "edgejobs": null,
   "endpoint_groups": [
@@ -121,10 +120,6 @@
       "Ecr": {
         "Region": ""
       },
-      "Github": {
-        "OrganisationName": "",
-        "UseOrganisation": false
-      },
       "Gitlab": {
         "InstanceURL": "",
         "ProjectId": 0,
@@ -615,7 +610,7 @@
       "RequiredPasswordLength": 12
     },
     "KubeconfigExpiry": "0",
-    "KubectlShellImage": "portainer/kubectl-shell:2.32.0",
+    "KubectlShellImage": "portainer/kubectl-shell:2.29.1",
     "LDAPSettings": {
       "AnonymousMode": true,
       "AutoCreateUsers": true,
@@ -683,11 +678,14 @@
           "Images": null,
           "Info": {
             "Architecture": "",
+            "BridgeNfIp6tables": false,
+            "BridgeNfIptables": false,
             "CDISpecDirs": null,
             "CPUSet": false,
             "CPUShares": false,
             "CgroupDriver": "",
             "ContainerdCommit": {
+              "Expected": "",
               "ID": ""
             },
             "Containers": 0,
@@ -711,6 +709,7 @@
             "IndexServerAddress": "",
             "InitBinary": "",
             "InitCommit": {
+              "Expected": "",
               "ID": ""
             },
             "Isolation": "",
@@ -739,6 +738,7 @@
             },
             "RegistryConfig": null,
             "RuncCommit": {
+              "Expected": "",
               "ID": ""
             },
             "Runtimes": null,
@@ -780,7 +780,6 @@
         "ImageCount": 9,
         "IsPodman": false,
         "NodeCount": 0,
-        "PerformanceMetrics": null,
         "RunningContainerCount": 5,
         "ServiceCount": 0,
         "StackCount": 2,
@@ -944,7 +943,7 @@
     }
   ],
   "version": {
-    "VERSION": "{\"SchemaVersion\":\"2.32.0\",\"MigratorCount\":1,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
+    "VERSION": "{\"SchemaVersion\":\"2.29.1\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
   },
   "webhooks": null
 }

api/datastore/validate/validate.go

@@ -0,0 +1,15 @@
+package validate
+
+import (
+	"github.com/go-playground/validator/v10"
+	portainer "github.com/portainer/portainer/api"
+)
+
+var validate *validator.Validate
+
+func ValidateLDAPSettings(ldp *portainer.LDAPSettings) error {
+	validate = validator.New()
+	registerValidationMethods(validate)
+
+	return validate.Struct(ldp)
+}

api/datastore/validate/validate_test.go

@@ -0,0 +1,61 @@
+package validate
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+func TestValidateLDAPSettings(t *testing.T) {
+
+	tests := []struct {
+		name    string
+		ldap    portainer.LDAPSettings
+		wantErr bool
+	}{
+		{
+			name:    "Empty LDAP Settings",
+			ldap:    portainer.LDAPSettings{},
+			wantErr: true,
+		},
+		{
+			name: "With URL",
+			ldap: portainer.LDAPSettings{
+				AnonymousMode: true,
+				URL:           "192.168.0.1:323",
+			},
+			wantErr: false,
+		},
+		{
+			name: "Validate URL and URLs",
+			ldap: portainer.LDAPSettings{
+				AnonymousMode: true,
+				URL:           "192.168.0.1:323",
+			},
+			wantErr: false,
+		},
+		{
+			name: "validate client ldap",
+			ldap: portainer.LDAPSettings{
+				AnonymousMode: false,
+				ReaderDN:      "CN=LDAP API Service Account",
+				Password:      "Qu**dfUUU**",
+				URL:           "aukdc15.pgc.co:389",
+				TLSConfig: portainer.TLSConfiguration{
+					TLS:           false,
+					TLSSkipVerify: false,
+				},
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidateLDAPSettings(&tt.ldap)
+			if (err == nil) == tt.wantErr {
+				t.Errorf("No error expected but got %s", err)
+			}
+		})
+	}
+}

api/datastore/validate/validationMethods.go

@@ -0,0 +1,17 @@
+package validate
+
+import (
+	"github.com/go-playground/validator/v10"
+)
+
+func registerValidationMethods(v *validator.Validate) {
+	v.RegisterValidation("validate_bool", ValidateBool)
+}
+
+/**
+ * Validation methods below are being used for custom validation
+ */
+func ValidateBool(fl validator.FieldLevel) bool {
+	_, ok := fl.Field().Interface().(bool)
+	return ok
+}

api/docker/client/client.go

@@ -73,6 +73,19 @@ func createLocalClient(endpoint *portainer.Endpoint) (*client.Client, error) {
 	)
 }
 
+func CreateClientFromEnv() (*client.Client, error) {
+	return client.NewClientWithOpts(
+		client.FromEnv,
+		client.WithAPIVersionNegotiation(),
+	)
+}
+
+func CreateSimpleClient() (*client.Client, error) {
+	return client.NewClientWithOpts(
+		client.WithAPIVersionNegotiation(),
+	)
+}
+
 func createTCPClient(endpoint *portainer.Endpoint, timeout *time.Duration) (*client.Client, error) {
 	httpCli, err := httpClient(endpoint, timeout)
 	if err != nil {

api/docker/images/digest.go

@@ -38,10 +38,10 @@ func NewClientWithRegistry(registryClient *RegistryClient, clientFactory *docker
 func (c *DigestClient) RemoteDigest(image Image) (digest.Digest, error) {
 	ctx, cancel := c.timeoutContext()
 	defer cancel()
-
 	// Docker references with both a tag and digest are currently not supported
 	if image.Tag != "" && image.Digest != "" {
-		if err := image.TrimDigest(); err != nil {
+		err := image.trimDigest()
+		if err != nil {
 			return "", err
 		}
 	}
@@ -69,7 +69,7 @@ func (c *DigestClient) RemoteDigest(image Image) (digest.Digest, error) {
 	// Retrieve remote digest through HEAD request
 	rmDigest, err := docker.GetDigest(ctx, sysCtx, rmRef)
 	if err != nil {
-		// Fallback to public registry for hub
+		// fallback to public registry for hub
 		if image.HubLink != "" {
 			rmDigest, err = docker.GetDigest(ctx, c.sysCtx, rmRef)
 			if err == nil {
@@ -131,7 +131,8 @@ func ParseRepoDigests(repoDigests []string) []digest.Digest {
 func ParseRepoTags(repoTags []string) []*Image {
 	images := make([]*Image, 0)
 	for _, repoTag := range repoTags {
-		if image := ParseRepoTag(repoTag); image != nil {
+		image := ParseRepoTag(repoTag)
+		if image != nil {
 			images = append(images, image)
 		}
 	}
@@ -146,7 +147,7 @@ func ParseRepoDigest(repoDigest string) digest.Digest {
 
 	d, err := digest.Parse(strings.Split(repoDigest, "@")[1])
 	if err != nil {
-		log.Warn().Err(err).Str("digest", repoDigest).Msg("skip invalid repo item")
+		log.Warn().Msgf("Skip invalid repo digest item: %s [error: %v]", repoDigest, err)
 
 		return ""
 	}

api/docker/images/image.go

@@ -26,7 +26,7 @@ type Image struct {
 	Digest  digest.Digest
 	HubLink string
 	named   reference.Named
-	Opts    ParseImageOptions `json:"-"`
+	opts    ParseImageOptions
 }
 
 // ParseImageOptions holds image options for parsing.
@@ -43,10 +43,9 @@ func (i *Image) Name() string {
 // FullName return the real full name may include Tag or Digest of the image, Tag first.
 func (i *Image) FullName() string {
 	if i.Tag == "" {
-		return i.Name() + "@" + i.Digest.String()
+		return fmt.Sprintf("%s@%s", i.Name(), i.Digest)
 	}
-
-	return i.Name() + ":" + i.Tag
+	return fmt.Sprintf("%s:%s", i.Name(), i.Tag)
 }
 
 // String returns the string representation of an image, including Tag and Digest if existed.
@@ -67,25 +66,22 @@ func (i *Image) Reference() string {
 func (i *Image) WithDigest(digest digest.Digest) (err error) {
 	i.Digest = digest
 	i.named, err = reference.WithDigest(i.named, digest)
-
 	return err
 }
 
 func (i *Image) WithTag(tag string) (err error) {
 	i.Tag = tag
 	i.named, err = reference.WithTag(i.named, tag)
-
 	return err
 }
 
-func (i *Image) TrimDigest() error {
+func (i *Image) trimDigest() error {
 	i.Digest = ""
 	named, err := ParseImage(ParseImageOptions{Name: i.FullName()})
 	if err != nil {
 		return err
 	}
 	i.named = &named
-
 	return nil
 }
 
@@ -96,12 +92,11 @@ func ParseImage(parseOpts ParseImageOptions) (Image, error) {
 	if err != nil {
 		return Image{}, errors.Wrapf(err, "parsing image %s failed", parseOpts.Name)
 	}
-
 	// Add the latest lag if they did not provide one.
 	named = reference.TagNameOnly(named)
 
 	i := Image{
-		Opts:   parseOpts,
+		opts:   parseOpts,
 		named:  named,
 		Domain: reference.Domain(named),
 		Path:   reference.Path(named),
@@ -127,16 +122,15 @@ func ParseImage(parseOpts ParseImageOptions) (Image, error) {
 }
 
 func (i *Image) hubLink() (string, error) {
-	if i.Opts.HubTpl != "" {
+	if i.opts.HubTpl != "" {
 		var out bytes.Buffer
 		tmpl, err := template.New("tmpl").
 			Option("missingkey=error").
-			Parse(i.Opts.HubTpl)
+			Parse(i.opts.HubTpl)
 		if err != nil {
 			return "", err
 		}
 		err = tmpl.Execute(&out, i)
-
 		return out.String(), err
 	}
 
@@ -148,7 +142,6 @@ func (i *Image) hubLink() (string, error) {
 			prefix = "_"
 			path = strings.Replace(i.Path, "library/", "", 1)
 		}
-
 		return "https://hub.docker.com/" + prefix + "/" + path, nil
 	case "docker.bintray.io", "jfrog-docker-reg2.bintray.io":
 		return "https://bintray.com/jfrog/reg2/" + strings.ReplaceAll(i.Path, "/", "%3A"), nil

api/docker/images/image_test.go

@@ -16,7 +16,7 @@ func TestImageParser(t *testing.T) {
 		})
 		is.NoError(err, "")
 		is.Equal("docker.io/portainer/portainer-ee:latest", image.FullName())
-		is.Equal("portainer/portainer-ee", image.Opts.Name)
+		is.Equal("portainer/portainer-ee", image.opts.Name)
 		is.Equal("latest", image.Tag)
 		is.Equal("portainer/portainer-ee", image.Path)
 		is.Equal("docker.io", image.Domain)
@@ -32,7 +32,7 @@ func TestImageParser(t *testing.T) {
 		})
 		is.NoError(err, "")
 		is.Equal("gcr.io/k8s-minikube/kicbase@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.FullName())
-		is.Equal("gcr.io/k8s-minikube/kicbase@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
+		is.Equal("gcr.io/k8s-minikube/kicbase@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.opts.Name)
 		is.Equal("", image.Tag)
 		is.Equal("k8s-minikube/kicbase", image.Path)
 		is.Equal("gcr.io", image.Domain)
@@ -49,7 +49,7 @@ func TestImageParser(t *testing.T) {
 		})
 		is.NoError(err, "")
 		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30", image.FullName())
-		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.opts.Name)
 		is.Equal("v0.0.30", image.Tag)
 		is.Equal("k8s-minikube/kicbase", image.Path)
 		is.Equal("gcr.io", image.Domain)
@@ -71,7 +71,7 @@ func TestUpdateParsedImage(t *testing.T) {
 		is.NoError(err, "")
 		_ = image.WithTag("v0.0.31")
 		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.31", image.FullName())
-		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.opts.Name)
 		is.Equal("v0.0.31", image.Tag)
 		is.Equal("k8s-minikube/kicbase", image.Path)
 		is.Equal("gcr.io", image.Domain)
@@ -89,7 +89,7 @@ func TestUpdateParsedImage(t *testing.T) {
 		is.NoError(err, "")
 		_ = image.WithDigest("sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b3")
 		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30", image.FullName())
-		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.opts.Name)
 		is.Equal("v0.0.30", image.Tag)
 		is.Equal("k8s-minikube/kicbase", image.Path)
 		is.Equal("gcr.io", image.Domain)
@@ -105,9 +105,9 @@ func TestUpdateParsedImage(t *testing.T) {
 			Name: "gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2",
 		})
 		is.NoError(err, "")
-		_ = image.TrimDigest()
+		_ = image.trimDigest()
 		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30", image.FullName())
-		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
+		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.opts.Name)
 		is.Equal("v0.0.30", image.Tag)
 		is.Equal("k8s-minikube/kicbase", image.Path)
 		is.Equal("gcr.io", image.Domain)

api/docker/images/registry.go

@@ -29,7 +29,7 @@ func (c *RegistryClient) RegistryAuth(image Image) (string, string, error) {
 		return "", "", err
 	}
 
-	registry, err := findBestMatchRegistry(image.Opts.Name, registries)
+	registry, err := findBestMatchRegistry(image.opts.Name, registries)
 	if err != nil {
 		return "", "", err
 	}
@@ -59,7 +59,7 @@ func (c *RegistryClient) EncodedRegistryAuth(image Image) (string, error) {
 		return "", err
 	}
 
-	registry, err := findBestMatchRegistry(image.Opts.Name, registries)
+	registry, err := findBestMatchRegistry(image.opts.Name, registries)
 	if err != nil {
 		return "", err
 	}

api/exec/exectest/kubernetes_mocks.go

@@ -12,15 +12,3 @@ type kubernetesMockDeployer struct {
 func NewKubernetesDeployer() *kubernetesMockDeployer {
 	return &kubernetesMockDeployer{}
 }
-
-func (deployer *kubernetesMockDeployer) Deploy(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
-	return "", nil
-}
-
-func (deployer *kubernetesMockDeployer) Remove(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
-	return "", nil
-}
-
-func (deployer *kubernetesMockDeployer) Restart(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
-	return "", nil
-}

api/exec/kubernetes_deploy.go

@@ -1,8 +1,13 @@
 package exec
 
 import (
-	"context"
+	"bytes"
 	"fmt"
+	"os"
+	"os/exec"
+	"path"
+	"runtime"
+	"strings"
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
@@ -10,17 +15,13 @@ import (
 	"github.com/portainer/portainer/api/http/proxy/factory"
 	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
 	"github.com/portainer/portainer/api/kubernetes/cli"
-	"github.com/portainer/portainer/pkg/libkubectl"
 
 	"github.com/pkg/errors"
 )
 
-const (
-	defaultServerURL = "https://kubernetes.default.svc"
-)
-
 // KubernetesDeployer represents a service to deploy resources inside a Kubernetes environment(endpoint).
 type KubernetesDeployer struct {
+	binaryPath                  string
 	dataStore                   dataservices.DataStore
 	reverseTunnelService        portainer.ReverseTunnelService
 	signatureService            portainer.DigitalSignatureService
@@ -30,8 +31,9 @@ type KubernetesDeployer struct {
 }
 
 // NewKubernetesDeployer initializes a new KubernetesDeployer service.
-func NewKubernetesDeployer(kubernetesTokenCacheManager *kubernetes.TokenCacheManager, kubernetesClientFactory *cli.ClientFactory, datastore dataservices.DataStore, reverseTunnelService portainer.ReverseTunnelService, signatureService portainer.DigitalSignatureService, proxyManager *proxy.Manager) *KubernetesDeployer {
+func NewKubernetesDeployer(kubernetesTokenCacheManager *kubernetes.TokenCacheManager, kubernetesClientFactory *cli.ClientFactory, datastore dataservices.DataStore, reverseTunnelService portainer.ReverseTunnelService, signatureService portainer.DigitalSignatureService, proxyManager *proxy.Manager, binaryPath string) *KubernetesDeployer {
 	return &KubernetesDeployer{
+		binaryPath:                  binaryPath,
 		dataStore:                   datastore,
 		reverseTunnelService:        reverseTunnelService,
 		signatureService:            signatureService,
@@ -76,56 +78,63 @@ func (deployer *KubernetesDeployer) getToken(userID portainer.UserID, endpoint *
 }
 
 // Deploy upserts Kubernetes resources defined in manifest(s)
-func (deployer *KubernetesDeployer) Deploy(userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
-	return deployer.command("apply", userID, endpoint, resources, namespace)
+func (deployer *KubernetesDeployer) Deploy(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+	return deployer.command("apply", userID, endpoint, manifestFiles, namespace)
 }
 
 // Remove deletes Kubernetes resources defined in manifest(s)
-func (deployer *KubernetesDeployer) Remove(userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
-	return deployer.command("delete", userID, endpoint, resources, namespace)
+func (deployer *KubernetesDeployer) Remove(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+	return deployer.command("delete", userID, endpoint, manifestFiles, namespace)
 }
 
-func (deployer *KubernetesDeployer) command(operation string, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+func (deployer *KubernetesDeployer) command(operation string, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
 	token, err := deployer.getToken(userID, endpoint, endpoint.Type == portainer.KubernetesLocalEnvironment)
 	if err != nil {
 		return "", errors.Wrap(err, "failed generating a user token")
 	}
 
-	serverURL := defaultServerURL
+	command := path.Join(deployer.binaryPath, "kubectl")
+	if runtime.GOOS == "windows" {
+		command = path.Join(deployer.binaryPath, "kubectl.exe")
+	}
+
+	args := []string{"--token", token}
+	if namespace != "" {
+		args = append(args, "--namespace", namespace)
+	}
+
 	if endpoint.Type == portainer.AgentOnKubernetesEnvironment || endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment {
 		url, proxy, err := deployer.getAgentURL(endpoint)
 		if err != nil {
 			return "", errors.WithMessage(err, "failed generating endpoint URL")
 		}
+
 		defer proxy.Close()
-
-		serverURL = url
+		args = append(args, "--server", url)
+		args = append(args, "--insecure-skip-tls-verify")
 	}
 
-	client, err := libkubectl.NewClient(&libkubectl.ClientAccess{
-		Token:     token,
-		ServerUrl: serverURL,
-	}, namespace, "", true)
+	if operation == "delete" {
+		args = append(args, "--ignore-not-found=true")
+	}
+
+	args = append(args, operation)
+	for _, path := range manifestFiles {
+		args = append(args, "-f", strings.TrimSpace(path))
+	}
+
+	var stderr bytes.Buffer
+	cmd := exec.Command(command, args...)
+	cmd.Env = os.Environ()
+	cmd.Env = append(cmd.Env, "POD_NAMESPACE=default")
+	cmd.Stderr = &stderr
+
+	output, err := cmd.Output()
 	if err != nil {
-		return "", errors.Wrap(err, "failed to create kubectl client")
+		return "", errors.Wrapf(err, "failed to execute kubectl command: %q", stderr.String())
 	}
 
-	operations := map[string]func(context.Context, []string) (string, error){
-		"apply":  client.Apply,
-		"delete": client.Delete,
-	}
-
-	operationFunc, ok := operations[operation]
-	if !ok {
-		return "", errors.Errorf("unsupported operation: %s", operation)
-	}
-
-	output, err := operationFunc(context.Background(), resources)
-	if err != nil {
-		return "", errors.Wrapf(err, "failed to execute kubectl %s command", operation)
-	}
-
-	return output, nil
+	return string(output), nil
 }
 
 func (deployer *KubernetesDeployer) getAgentURL(endpoint *portainer.Endpoint) (string, *factory.ProxyServer, error) {

api/exec/kubernetes_deploy_test.go

@@ -1,173 +0,0 @@
-package exec
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-type mockKubectlClient struct {
-	applyFunc          func(ctx context.Context, files []string) error
-	deleteFunc         func(ctx context.Context, files []string) error
-	rolloutRestartFunc func(ctx context.Context, resources []string) error
-}
-
-func (m *mockKubectlClient) Apply(ctx context.Context, files []string) error {
-	if m.applyFunc != nil {
-		return m.applyFunc(ctx, files)
-	}
-	return nil
-}
-
-func (m *mockKubectlClient) Delete(ctx context.Context, files []string) error {
-	if m.deleteFunc != nil {
-		return m.deleteFunc(ctx, files)
-	}
-	return nil
-}
-
-func (m *mockKubectlClient) RolloutRestart(ctx context.Context, resources []string) error {
-	if m.rolloutRestartFunc != nil {
-		return m.rolloutRestartFunc(ctx, resources)
-	}
-	return nil
-}
-
-func testExecuteKubectlOperation(client *mockKubectlClient, operation string, manifestFiles []string) error {
-	operations := map[string]func(context.Context, []string) error{
-		"apply":           client.Apply,
-		"delete":          client.Delete,
-		"rollout-restart": client.RolloutRestart,
-	}
-
-	operationFunc, ok := operations[operation]
-	if !ok {
-		return fmt.Errorf("unsupported operation: %s", operation)
-	}
-
-	if err := operationFunc(context.Background(), manifestFiles); err != nil {
-		return fmt.Errorf("failed to execute kubectl %s command: %w", operation, err)
-	}
-
-	return nil
-}
-
-func TestExecuteKubectlOperation_Apply_Success(t *testing.T) {
-	called := false
-	mockClient := &mockKubectlClient{
-		applyFunc: func(ctx context.Context, files []string) error {
-			called = true
-			assert.Equal(t, []string{"manifest1.yaml", "manifest2.yaml"}, files)
-			return nil
-		},
-	}
-
-	manifests := []string{"manifest1.yaml", "manifest2.yaml"}
-	err := testExecuteKubectlOperation(mockClient, "apply", manifests)
-
-	assert.NoError(t, err)
-	assert.True(t, called)
-}
-
-func TestExecuteKubectlOperation_Apply_Error(t *testing.T) {
-	expectedErr := errors.New("kubectl apply failed")
-	called := false
-	mockClient := &mockKubectlClient{
-		applyFunc: func(ctx context.Context, files []string) error {
-			called = true
-			assert.Equal(t, []string{"error.yaml"}, files)
-			return expectedErr
-		},
-	}
-
-	manifests := []string{"error.yaml"}
-	err := testExecuteKubectlOperation(mockClient, "apply", manifests)
-
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), expectedErr.Error())
-	assert.True(t, called)
-}
-
-func TestExecuteKubectlOperation_Delete_Success(t *testing.T) {
-	called := false
-	mockClient := &mockKubectlClient{
-		deleteFunc: func(ctx context.Context, files []string) error {
-			called = true
-			assert.Equal(t, []string{"manifest1.yaml"}, files)
-			return nil
-		},
-	}
-
-	manifests := []string{"manifest1.yaml"}
-	err := testExecuteKubectlOperation(mockClient, "delete", manifests)
-
-	assert.NoError(t, err)
-	assert.True(t, called)
-}
-
-func TestExecuteKubectlOperation_Delete_Error(t *testing.T) {
-	expectedErr := errors.New("kubectl delete failed")
-	called := false
-	mockClient := &mockKubectlClient{
-		deleteFunc: func(ctx context.Context, files []string) error {
-			called = true
-			assert.Equal(t, []string{"error.yaml"}, files)
-			return expectedErr
-		},
-	}
-
-	manifests := []string{"error.yaml"}
-	err := testExecuteKubectlOperation(mockClient, "delete", manifests)
-
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), expectedErr.Error())
-	assert.True(t, called)
-}
-
-func TestExecuteKubectlOperation_RolloutRestart_Success(t *testing.T) {
-	called := false
-	mockClient := &mockKubectlClient{
-		rolloutRestartFunc: func(ctx context.Context, resources []string) error {
-			called = true
-			assert.Equal(t, []string{"deployment/nginx"}, resources)
-			return nil
-		},
-	}
-
-	resources := []string{"deployment/nginx"}
-	err := testExecuteKubectlOperation(mockClient, "rollout-restart", resources)
-
-	assert.NoError(t, err)
-	assert.True(t, called)
-}
-
-func TestExecuteKubectlOperation_RolloutRestart_Error(t *testing.T) {
-	expectedErr := errors.New("kubectl rollout restart failed")
-	called := false
-	mockClient := &mockKubectlClient{
-		rolloutRestartFunc: func(ctx context.Context, resources []string) error {
-			called = true
-			assert.Equal(t, []string{"deployment/error"}, resources)
-			return expectedErr
-		},
-	}
-
-	resources := []string{"deployment/error"}
-	err := testExecuteKubectlOperation(mockClient, "rollout-restart", resources)
-
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), expectedErr.Error())
-	assert.True(t, called)
-}
-
-func TestExecuteKubectlOperation_UnsupportedOperation(t *testing.T) {
-	mockClient := &mockKubectlClient{}
-
-	err := testExecuteKubectlOperation(mockClient, "unsupported", []string{})
-
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "unsupported operation")
-}

api/git/update/validate.go

@@ -3,9 +3,9 @@ package update
 import (
 	"time"
 
+	"github.com/asaskevich/govalidator"
 	portainer "github.com/portainer/portainer/api"
 	httperrors "github.com/portainer/portainer/api/http/errors"
-	"github.com/portainer/portainer/pkg/validate"
 )
 
 func ValidateAutoUpdateSettings(autoUpdate *portainer.AutoUpdateSettings) error {
@@ -17,7 +17,7 @@ func ValidateAutoUpdateSettings(autoUpdate *portainer.AutoUpdateSettings) error
 		return httperrors.NewInvalidPayloadError("Webhook or Interval must be provided")
 	}
 
-	if autoUpdate.Webhook != "" && !validate.IsUUID(autoUpdate.Webhook) {
+	if autoUpdate.Webhook != "" && !govalidator.IsUUID(autoUpdate.Webhook) {
 		return httperrors.NewInvalidPayloadError("invalid Webhook format")
 	}
 

api/git/validate.go

@@ -1,17 +1,19 @@
 package git
 
 import (
+	"github.com/asaskevich/govalidator"
+
 	gittypes "github.com/portainer/portainer/api/git/types"
 	httperrors "github.com/portainer/portainer/api/http/errors"
-	"github.com/portainer/portainer/pkg/validate"
 )
 
 func ValidateRepoConfig(repoConfig *gittypes.RepoConfig) error {
-	if len(repoConfig.URL) == 0 || !validate.IsURL(repoConfig.URL) {
+	if len(repoConfig.URL) == 0 || !govalidator.IsURL(repoConfig.URL) {
 		return httperrors.NewInvalidPayloadError("Invalid repository URL. Must correspond to a valid URL format")
 	}
 
 	return ValidateRepoAuthentication(repoConfig.Authentication)
+
 }
 
 func ValidateRepoAuthentication(auth *gittypes.GitAuthentication) error {

api/hostmanagement/openamt/openamt.go

@@ -32,9 +32,9 @@ type Service struct {
 }
 
 // NewService initializes a new service.
-func NewService(insecureSkipVerify bool) *Service {
+func NewService() *Service {
 	tlsConfig := crypto.CreateTLSConfiguration()
-	tlsConfig.InsecureSkipVerify = insecureSkipVerify
+	tlsConfig.InsecureSkipVerify = true
 
 	return &Service{
 		httpsClient: &http.Client{

api/http/csrf/csrf.go

@@ -2,7 +2,6 @@ package csrf
 
 import (
 	"crypto/rand"
-	"errors"
 	"fmt"
 	"net/http"
 	"os"
@@ -10,8 +9,7 @@ import (
 	"github.com/portainer/portainer/api/http/security"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 
-	gcsrf "github.com/gorilla/csrf"
-	"github.com/rs/zerolog/log"
+	gorillacsrf "github.com/gorilla/csrf"
 	"github.com/urfave/negroni"
 )
 
@@ -21,7 +19,7 @@ func SkipCSRFToken(w http.ResponseWriter) {
 	w.Header().Set(csrfSkipHeader, "1")
 }
 
-func WithProtect(handler http.Handler, trustedOrigins []string) (http.Handler, error) {
+func WithProtect(handler http.Handler) (http.Handler, error) {
 	// IsDockerDesktopExtension is used to check if we should skip csrf checks in the request bouncer (ShouldSkipCSRFCheck)
 	// DOCKER_EXTENSION is set to '1' in build/docker-extension/docker-compose.yml
 	isDockerDesktopExtension := false
@@ -36,12 +34,10 @@ func WithProtect(handler http.Handler, trustedOrigins []string) (http.Handler, e
 		return nil, fmt.Errorf("failed to generate CSRF token: %w", err)
 	}
 
-	handler = gcsrf.Protect(
+	handler = gorillacsrf.Protect(
 		token,
-		gcsrf.Path("/"),
-		gcsrf.Secure(false),
-		gcsrf.TrustedOrigins(trustedOrigins),
-		gcsrf.ErrorHandler(withErrorHandler(trustedOrigins)),
+		gorillacsrf.Path("/"),
+		gorillacsrf.Secure(false),
 	)(handler)
 
 	return withSkipCSRF(handler, isDockerDesktopExtension), nil
@@ -59,7 +55,7 @@ func withSendCSRFToken(handler http.Handler) http.Handler {
 			}
 
 			if statusCode := sw.Status(); statusCode >= 200 && statusCode < 300 {
-				sw.Header().Set("X-CSRF-Token", gcsrf.Token(r))
+				sw.Header().Set("X-CSRF-Token", gorillacsrf.Token(r))
 			}
 		})
 
@@ -77,33 +73,9 @@ func withSkipCSRF(handler http.Handler, isDockerDesktopExtension bool) http.Hand
 		}
 
 		if skip {
-			r = gcsrf.UnsafeSkipCheck(r)
+			r = gorillacsrf.UnsafeSkipCheck(r)
 		}
 
 		handler.ServeHTTP(w, r)
 	})
 }
-
-func withErrorHandler(trustedOrigins []string) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		err := gcsrf.FailureReason(r)
-
-		if errors.Is(err, gcsrf.ErrBadOrigin) || errors.Is(err, gcsrf.ErrBadReferer) || errors.Is(err, gcsrf.ErrNoReferer) {
-			log.Error().Err(err).
-				Str("request_url", r.URL.String()).
-				Str("host", r.Host).
-				Str("x_forwarded_proto", r.Header.Get("X-Forwarded-Proto")).
-				Str("forwarded", r.Header.Get("Forwarded")).
-				Str("origin", r.Header.Get("Origin")).
-				Str("referer", r.Header.Get("Referer")).
-				Strs("trusted_origins", trustedOrigins).
-				Msg("Failed to validate Origin or Referer")
-		}
-
-		http.Error(
-			w,
-			http.StatusText(http.StatusForbidden)+" - "+err.Error(),
-			http.StatusForbidden,
-		)
-	})
-}

api/http/handler/auth/authenticate.go

@@ -2,7 +2,6 @@ package auth
 
 import (
 	"net/http"
-	"strconv"
 	"strings"
 
 	portainer "github.com/portainer/portainer/api"
@@ -83,11 +82,6 @@ func (handler *Handler) authenticate(rw http.ResponseWriter, r *http.Request) *h
 		}
 	}
 
-	// Clear any existing user caches
-	if user != nil {
-		handler.KubernetesClientFactory.ClearUserClientCache(strconv.Itoa(int(user.ID)))
-	}
-
 	if user != nil && isUserInitialAdmin(user) || settings.AuthenticationMethod == portainer.AuthenticationInternal {
 		return handler.authenticateInternal(rw, user, payload.Password)
 	}

api/http/handler/auth/handler.go

@@ -8,7 +8,6 @@ import (
 	"github.com/portainer/portainer/api/http/proxy"
 	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
 	"github.com/portainer/portainer/api/http/security"
-	"github.com/portainer/portainer/api/kubernetes/cli"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 
 	"github.com/gorilla/mux"
@@ -24,18 +23,16 @@ type Handler struct {
 	OAuthService                portainer.OAuthService
 	ProxyManager                *proxy.Manager
 	KubernetesTokenCacheManager *kubernetes.TokenCacheManager
-	KubernetesClientFactory     *cli.ClientFactory
 	passwordStrengthChecker     security.PasswordStrengthChecker
 	bouncer                     security.BouncerService
 }
 
 // NewHandler creates a handler to manage authentication operations.
-func NewHandler(bouncer security.BouncerService, rateLimiter *security.RateLimiter, passwordStrengthChecker security.PasswordStrengthChecker, kubernetesClientFactory *cli.ClientFactory) *Handler {
+func NewHandler(bouncer security.BouncerService, rateLimiter *security.RateLimiter, passwordStrengthChecker security.PasswordStrengthChecker) *Handler {
 	h := &Handler{
 		Router:                  mux.NewRouter(),
 		passwordStrengthChecker: passwordStrengthChecker,
 		bouncer:                 bouncer,
-		KubernetesClientFactory: kubernetesClientFactory,
 	}
 
 	h.Handle("/auth/oauth/validate",

api/http/handler/auth/logout.go

@@ -2,7 +2,6 @@ package auth
 
 import (
 	"net/http"
-	"strconv"
 
 	"github.com/portainer/portainer/api/http/security"
 	"github.com/portainer/portainer/api/logoutcontext"
@@ -24,7 +23,6 @@ func (handler *Handler) logout(w http.ResponseWriter, r *http.Request) *httperro
 
 	if tokenData != nil {
 		handler.KubernetesTokenCacheManager.RemoveUserFromCache(tokenData.ID)
-		handler.KubernetesClientFactory.ClearUserClientCache(strconv.Itoa(int(tokenData.ID)))
 		logoutcontext.Cancel(tokenData.Token)
 	}
 

api/http/handler/customtemplates/customtemplate_create.go

@@ -16,8 +16,8 @@ import (
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
-	"github.com/portainer/portainer/pkg/validate"
 
+	"github.com/asaskevich/govalidator"
 	"github.com/rs/zerolog/log"
 	"github.com/segmentio/encoding/json"
 )
@@ -228,7 +228,7 @@ func (payload *customTemplateFromGitRepositoryPayload) Validate(r *http.Request)
 	if len(payload.Description) == 0 {
 		return errors.New("Invalid custom template description")
 	}
-	if len(payload.RepositoryURL) == 0 || !validate.IsURL(payload.RepositoryURL) {
+	if len(payload.RepositoryURL) == 0 || !govalidator.IsURL(payload.RepositoryURL) {
 		return errors.New("Invalid repository URL. Must correspond to a valid URL format")
 	}
 	if payload.RepositoryAuthentication && (len(payload.RepositoryUsername) == 0 || len(payload.RepositoryPassword) == 0) {

api/http/handler/customtemplates/customtemplate_list.go

@@ -71,7 +71,7 @@ func (handler *Handler) customTemplateList(w http.ResponseWriter, r *http.Reques
 	customTemplates = filterByType(customTemplates, templateTypes)
 
 	if edge != nil {
-		customTemplates = slicesx.FilterInPlace(customTemplates, func(customTemplate portainer.CustomTemplate) bool {
+		customTemplates = slicesx.Filter(customTemplates, func(customTemplate portainer.CustomTemplate) bool {
 			return customTemplate.EdgeTemplate == *edge
 		})
 	}

api/http/handler/customtemplates/customtemplate_update.go

@@ -15,7 +15,8 @@ import (
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
-	"github.com/portainer/portainer/pkg/validate"
+
+	"github.com/asaskevich/govalidator"
 )
 
 type customTemplateUpdatePayload struct {
@@ -169,7 +170,7 @@ func (handler *Handler) customTemplateUpdate(w http.ResponseWriter, r *http.Requ
 	customTemplate.EdgeTemplate = payload.EdgeTemplate
 
 	if payload.RepositoryURL != "" {
-		if !validate.IsURL(payload.RepositoryURL) {
+		if !govalidator.IsURL(payload.RepositoryURL) {
 			return httperror.BadRequest("Invalid repository URL. Must correspond to a valid URL format", err)
 		}
 

api/http/handler/docker/dashboard.go

@@ -6,7 +6,6 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/image"
-	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/swarm"
 	"github.com/docker/docker/api/types/volume"
 	portainer "github.com/portainer/portainer/api"
@@ -117,12 +116,12 @@ func (h *Handler) dashboard(w http.ResponseWriter, r *http.Request) *httperror.H
 			return err
 		}
 
-		networks, err := cli.NetworkList(r.Context(), network.ListOptions{})
+		networks, err := cli.NetworkList(r.Context(), types.NetworkListOptions{})
 		if err != nil {
 			return httperror.InternalServerError("Unable to retrieve Docker networks", err)
 		}
 
-		networks, err = utils.FilterByResourceControl(tx, networks, portainer.NetworkResourceControl, context, func(c network.Summary) string {
+		networks, err = utils.FilterByResourceControl(tx, networks, portainer.NetworkResourceControl, context, func(c types.NetworkResource) string {
 			return c.Name
 		})
 		if err != nil {

api/http/handler/edgegroups/edgegroup_update.go

@@ -163,7 +163,7 @@ func (handler *Handler) edgeGroupUpdate(w http.ResponseWriter, r *http.Request)
 
 func (handler *Handler) updateEndpointStacks(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint, edgeGroups []portainer.EdgeGroup, edgeStacks []portainer.EdgeStack) error {
 	relation, err := tx.EndpointRelation().EndpointRelation(endpoint.ID)
-	if err != nil {
+	if err != nil && !handler.DataStore.IsErrObjectNotFound(err) {
 		return err
 	}
 
@@ -179,6 +179,12 @@ func (handler *Handler) updateEndpointStacks(tx dataservices.DataStoreTx, endpoi
 		edgeStackSet[edgeStackID] = true
 	}
 
+	if relation == nil {
+		relation = &portainer.EndpointRelation{
+			EndpointID: endpoint.ID,
+			EdgeStacks: make(map[portainer.EdgeStackID]bool),
+		}
+	}
 	relation.EdgeStacks = edgeStackSet
 
 	return tx.EndpointRelation().UpdateEndpointRelation(endpoint.ID, relation)

api/http/handler/edgejobs/edgejob_create.go

@@ -15,7 +15,8 @@ import (
 	"github.com/portainer/portainer/api/internal/endpointutils"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
-	"github.com/portainer/portainer/pkg/validate"
+
+	"github.com/asaskevich/govalidator"
 )
 
 type edgeJobBasePayload struct {
@@ -52,7 +53,7 @@ func (payload *edgeJobCreateFromFileContentPayload) Validate(r *http.Request) er
 		return errors.New("invalid Edge job name")
 	}
 
-	if !validate.Matches(payload.Name, `^[a-zA-Z0-9][a-zA-Z0-9_.-]*$`) {
+	if !govalidator.Matches(payload.Name, `^[a-zA-Z0-9][a-zA-Z0-9_.-]*$`) {
 		return errors.New("invalid Edge job name format. Allowed characters are: [a-zA-Z0-9_.-]")
 	}
 
@@ -135,7 +136,7 @@ func (payload *edgeJobCreateFromFilePayload) Validate(r *http.Request) error {
 		return errors.New("invalid Edge job name")
 	}
 
-	if !validate.Matches(name, `^[a-zA-Z0-9][a-zA-Z0-9_.-]+$`) {
+	if !govalidator.Matches(name, `^[a-zA-Z0-9][a-zA-Z0-9_.-]+$`) {
 		return errors.New("invalid Edge job name format. Allowed characters are: [a-zA-Z0-9_.-]")
 	}
 	payload.Name = name

api/http/handler/edgejobs/edgejob_update.go

@@ -14,7 +14,8 @@ import (
 	"github.com/portainer/portainer/api/internal/endpointutils"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
-	"github.com/portainer/portainer/pkg/validate"
+
+	"github.com/asaskevich/govalidator"
 )
 
 type edgeJobUpdatePayload struct {
@@ -27,7 +28,7 @@ type edgeJobUpdatePayload struct {
 }
 
 func (payload *edgeJobUpdatePayload) Validate(r *http.Request) error {
-	if payload.Name != nil && !validate.Matches(*payload.Name, `^[a-zA-Z0-9][a-zA-Z0-9_.-]+$`) {
+	if payload.Name != nil && !govalidator.Matches(*payload.Name, `^[a-zA-Z0-9][a-zA-Z0-9_.-]+$`) {
 		return errors.New("invalid Edge job name format. Allowed characters are: [a-zA-Z0-9_.-]")
 	}
 

api/http/handler/edgestacks/edgestack_create_file.go

@@ -101,7 +101,8 @@ func (payload *edgeStackFromFileUploadPayload) Validate(r *http.Request) error {
 // @router /edge_stacks/create/file [post]
 func (handler *Handler) createEdgeStackFromFileUpload(r *http.Request, tx dataservices.DataStoreTx, dryrun bool) (*portainer.EdgeStack, error) {
 	payload := &edgeStackFromFileUploadPayload{}
-	if err := payload.Validate(r); err != nil {
+	err := payload.Validate(r)
+	if err != nil {
 		return nil, err
 	}
 

api/http/handler/edgestacks/edgestack_create_git.go

@@ -11,8 +11,8 @@ import (
 	httperrors "github.com/portainer/portainer/api/http/errors"
 	"github.com/portainer/portainer/pkg/edge"
 	"github.com/portainer/portainer/pkg/libhttp/request"
-	"github.com/portainer/portainer/pkg/validate"
 
+	"github.com/asaskevich/govalidator"
 	"github.com/pkg/errors"
 )
 
@@ -59,7 +59,7 @@ func (payload *edgeStackFromGitRepositoryPayload) Validate(r *http.Request) erro
 		return httperrors.NewInvalidPayloadError("Invalid stack name. Stack name must only consist of lowercase alpha characters, numbers, hyphens, or underscores as well as start with a lowercase character or number")
 	}
 
-	if len(payload.RepositoryURL) == 0 || !validate.IsURL(payload.RepositoryURL) {
+	if len(payload.RepositoryURL) == 0 || !govalidator.IsURL(payload.RepositoryURL) {
 		return httperrors.NewInvalidPayloadError("Invalid repository URL. Must correspond to a valid URL format")
 	}
 
@@ -103,7 +103,8 @@ func (payload *edgeStackFromGitRepositoryPayload) Validate(r *http.Request) erro
 // @router /edge_stacks/create/repository [post]
 func (handler *Handler) createEdgeStackFromGitRepository(r *http.Request, tx dataservices.DataStoreTx, dryrun bool, userID portainer.UserID) (*portainer.EdgeStack, error) {
 	var payload edgeStackFromGitRepositoryPayload
-	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
 		return nil, err
 	}
 
@@ -136,9 +137,11 @@ func (handler *Handler) createEdgeStackFromGitRepository(r *http.Request, tx dat
 }
 
 func (handler *Handler) storeManifestFromGitRepository(tx dataservices.DataStoreTx, stackFolder string, relatedEndpointIds []portainer.EndpointID, deploymentType portainer.EdgeStackDeploymentType, currentUserID portainer.UserID, repositoryConfig gittypes.RepoConfig) (composePath, manifestPath, projectPath string, err error) {
-	if hasWrongType, err := hasWrongEnvironmentType(tx.Endpoint(), relatedEndpointIds, deploymentType); err != nil {
+	hasWrongType, err := hasWrongEnvironmentType(tx.Endpoint(), relatedEndpointIds, deploymentType)
+	if err != nil {
 		return "", "", "", fmt.Errorf("unable to check for existence of non fitting environments: %w", err)
-	} else if hasWrongType {
+	}
+	if hasWrongType {
 		return "", "", "", errors.New("edge stack with config do not match the environment type")
 	}
 
@@ -150,7 +153,8 @@ func (handler *Handler) storeManifestFromGitRepository(tx dataservices.DataStore
 		repositoryPassword = repositoryConfig.Authentication.Password
 	}
 
-	if err := handler.GitService.CloneRepository(projectPath, repositoryConfig.URL, repositoryConfig.ReferenceName, repositoryUsername, repositoryPassword, repositoryConfig.TLSSkipVerify); err != nil {
+	err = handler.GitService.CloneRepository(projectPath, repositoryConfig.URL, repositoryConfig.ReferenceName, repositoryUsername, repositoryPassword, repositoryConfig.TLSSkipVerify)
+	if err != nil {
 		return "", "", "", err
 	}
 

api/http/handler/edgestacks/edgestack_create_string.go

@@ -76,7 +76,8 @@ func (payload *edgeStackFromStringPayload) Validate(r *http.Request) error {
 // @router /edge_stacks/create/string [post]
 func (handler *Handler) createEdgeStackFromFileContent(r *http.Request, tx dataservices.DataStoreTx, dryrun bool) (*portainer.EdgeStack, error) {
 	var payload edgeStackFromStringPayload
-	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
 		return nil, err
 	}
 
@@ -95,9 +96,11 @@ func (handler *Handler) createEdgeStackFromFileContent(r *http.Request, tx datas
 }
 
 func (handler *Handler) storeFileContent(tx dataservices.DataStoreTx, stackFolder string, deploymentType portainer.EdgeStackDeploymentType, relatedEndpointIds []portainer.EndpointID, fileContent []byte) (composePath, manifestPath, projectPath string, err error) {
-	if hasWrongType, err := hasWrongEnvironmentType(tx.Endpoint(), relatedEndpointIds, deploymentType); err != nil {
+	hasWrongType, err := hasWrongEnvironmentType(tx.Endpoint(), relatedEndpointIds, deploymentType)
+	if err != nil {
 		return "", "", "", fmt.Errorf("unable to check for existence of non fitting environments: %w", err)
-	} else if hasWrongType {
+	}
+	if hasWrongType {
 		return "", "", "", errors.New("edge stack with config do not match the environment type")
 	}
 
@@ -121,6 +124,7 @@ func (handler *Handler) storeFileContent(tx dataservices.DataStoreTx, stackFolde
 		}
 
 		return "", manifestPath, projectPath, nil
+
 	}
 
 	errMessage := fmt.Sprintf("invalid deployment type: %d", deploymentType)

api/http/handler/edgestacks/edgestack_create_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/stretchr/testify/require"
 
 	"github.com/segmentio/encoding/json"
 )
@@ -29,7 +28,9 @@ func TestCreateAndInspect(t *testing.T) {
 	}
 
 	err := handler.DataStore.EdgeGroup().Create(&edgeGroup)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	endpointRelation := portainer.EndpointRelation{
 		EndpointID: endpoint.ID,
@@ -37,7 +38,9 @@ func TestCreateAndInspect(t *testing.T) {
 	}
 
 	err = handler.DataStore.EndpointRelation().Create(&endpointRelation)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	payload := edgeStackFromStringPayload{
 		Name:             "test-stack",
@@ -47,14 +50,16 @@ func TestCreateAndInspect(t *testing.T) {
 	}
 
 	jsonPayload, err := json.Marshal(payload)
-	require.NoError(t, err)
-
+	if err != nil {
+		t.Fatal("JSON marshal error:", err)
+	}
 	r := bytes.NewBuffer(jsonPayload)
 
 	// Create EdgeStack
 	req, err := http.NewRequest(http.MethodPost, "/edge_stacks/create/string", r)
-	require.NoError(t, err)
-
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
 	req.Header.Add("x-api-key", rawAPIKey)
 	rec := httptest.NewRecorder()
 	handler.ServeHTTP(rec, req)
@@ -65,11 +70,15 @@ func TestCreateAndInspect(t *testing.T) {
 
 	data := portainer.EdgeStack{}
 	err = json.NewDecoder(rec.Body).Decode(&data)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("error decoding response:", err)
+	}
 
 	// Inspect
 	req, err = http.NewRequest(http.MethodGet, fmt.Sprintf("/edge_stacks/%d", data.ID), nil)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
 
 	req.Header.Add("x-api-key", rawAPIKey)
 	rec = httptest.NewRecorder()
@@ -81,7 +90,9 @@ func TestCreateAndInspect(t *testing.T) {
 
 	data = portainer.EdgeStack{}
 	err = json.NewDecoder(rec.Body).Decode(&data)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("error decoding response:", err)
+	}
 
 	if payload.Name != data.Name {
 		t.Fatalf("expected EdgeStack Name %s, found %s", payload.Name, data.Name)

api/http/handler/edgestacks/edgestack_delete.go

@@ -30,9 +30,10 @@ func (handler *Handler) edgeStackDelete(w http.ResponseWriter, r *http.Request)
 		return httperror.BadRequest("Invalid edge stack identifier route variable", err)
 	}
 
-	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
 		return handler.deleteEdgeStack(tx, portainer.EdgeStackID(edgeStackID))
-	}); err != nil {
+	})
+	if err != nil {
 		var httpErr *httperror.HandlerError
 		if errors.As(err, &httpErr) {
 			return httpErr

api/http/handler/edgestacks/edgestack_delete_test.go

@@ -8,10 +8,9 @@ import (
 	"testing"
 
 	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
 
 	"github.com/segmentio/encoding/json"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // Delete
@@ -24,7 +23,9 @@ func TestDeleteAndInspect(t *testing.T) {
 
 	// Inspect
 	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), nil)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
 
 	req.Header.Add("x-api-key", rawAPIKey)
 	rec := httptest.NewRecorder()
@@ -36,7 +37,9 @@ func TestDeleteAndInspect(t *testing.T) {
 
 	data := portainer.EdgeStack{}
 	err = json.NewDecoder(rec.Body).Decode(&data)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("error decoding response:", err)
+	}
 
 	if data.ID != edgeStack.ID {
 		t.Fatalf("expected EdgeStackID %d, found %d", int(edgeStack.ID), data.ID)
@@ -44,7 +47,9 @@ func TestDeleteAndInspect(t *testing.T) {
 
 	// Delete
 	req, err = http.NewRequest(http.MethodDelete, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), nil)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
 
 	req.Header.Add("x-api-key", rawAPIKey)
 	rec = httptest.NewRecorder()
@@ -56,7 +61,9 @@ func TestDeleteAndInspect(t *testing.T) {
 
 	// Inspect
 	req, err = http.NewRequest(http.MethodGet, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), nil)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
 
 	req.Header.Add("x-api-key", rawAPIKey)
 	rec = httptest.NewRecorder()
@@ -110,12 +117,15 @@ func TestDeleteEdgeStack_RemoveProjectFolder(t *testing.T) {
 	}
 
 	var buf bytes.Buffer
-	err := json.NewEncoder(&buf).Encode(payload)
-	require.NoError(t, err)
+	if err := json.NewEncoder(&buf).Encode(payload); err != nil {
+		t.Fatal("error encoding payload:", err)
+	}
 
 	// Create
 	req, err := http.NewRequest(http.MethodPost, "/edge_stacks/create/string", &buf)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
 
 	req.Header.Add("x-api-key", rawAPIKey)
 	rec := httptest.NewRecorder()
@@ -128,8 +138,9 @@ func TestDeleteEdgeStack_RemoveProjectFolder(t *testing.T) {
 	assert.DirExists(t, handler.FileService.GetEdgeStackProjectPath("1"))
 
 	// Delete
-	req, err = http.NewRequest(http.MethodDelete, "/edge_stacks/1", nil)
-	require.NoError(t, err)
+	if req, err = http.NewRequest(http.MethodDelete, "/edge_stacks/1", nil); err != nil {
+		t.Fatal("request error:", err)
+	}
 
 	req.Header.Add("x-api-key", rawAPIKey)
 	rec = httptest.NewRecorder()

api/http/handler/edgestacks/edgestack_inspect.go

@@ -4,7 +4,6 @@ import (
 	"net/http"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
@@ -34,35 +33,5 @@ func (handler *Handler) edgeStackInspect(w http.ResponseWriter, r *http.Request)
 		return handlerDBErr(err, "Unable to find an edge stack with the specified identifier inside the database")
 	}
 
-	if err := fillEdgeStackStatus(handler.DataStore, edgeStack); err != nil {
-		return handlerDBErr(err, "Unable to retrieve edge stack status from the database")
-	}
-
 	return response.JSON(w, edgeStack)
 }
-
-func fillEdgeStackStatus(tx dataservices.DataStoreTx, edgeStack *portainer.EdgeStack) error {
-	status, err := tx.EdgeStackStatus().ReadAll(edgeStack.ID)
-	if err != nil {
-		return err
-	}
-
-	edgeStack.Status = make(map[portainer.EndpointID]portainer.EdgeStackStatus, len(status))
-
-	emptyStatus := make([]portainer.EdgeStackDeploymentStatus, 0)
-
-	for _, s := range status {
-		if s.Status == nil {
-			s.Status = emptyStatus
-		}
-
-		edgeStack.Status[s.EndpointID] = portainer.EdgeStackStatus{
-			Status:           s.Status,
-			EndpointID:       s.EndpointID,
-			DeploymentInfo:   s.DeploymentInfo,
-			ReadyRePullImage: s.ReadyRePullImage,
-		}
-	}
-
-	return nil
-}

api/http/handler/edgestacks/edgestack_list.go

@@ -3,39 +3,10 @@ package edgestacks
 import (
 	"net/http"
 
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-	"github.com/portainer/portainer/api/slicesx"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
-	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
 )
 
-type aggregatedStatusesMap map[portainer.EdgeStackStatusType]int
-
-type SummarizedStatus string
-
-const (
-	sumStatusUnavailable      SummarizedStatus = "Unavailable"
-	sumStatusDeploying        SummarizedStatus = "Deploying"
-	sumStatusFailed           SummarizedStatus = "Failed"
-	sumStatusPaused           SummarizedStatus = "Paused"
-	sumStatusPartiallyRunning SummarizedStatus = "PartiallyRunning"
-	sumStatusCompleted        SummarizedStatus = "Completed"
-	sumStatusRunning          SummarizedStatus = "Running"
-)
-
-type edgeStackStatusSummary struct {
-	AggregatedStatus aggregatedStatusesMap
-	Status           SummarizedStatus
-	Reason           string
-}
-
-type edgeStackListResponseItem struct {
-	portainer.EdgeStack
-	StatusSummary edgeStackStatusSummary
-}
-
 // @id EdgeStackList
 // @summary Fetches the list of EdgeStacks
 // @description **Access policy**: administrator
@@ -43,122 +14,16 @@ type edgeStackListResponseItem struct {
 // @security ApiKeyAuth
 // @security jwt
 // @produce json
-// @param summarizeStatuses query boolean false "will summarize the statuses"
 // @success 200 {array} portainer.EdgeStack
 // @failure 500
 // @failure 400
 // @failure 503 "Edge compute features are disabled"
 // @router /edge_stacks [get]
 func (handler *Handler) edgeStackList(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
-	summarizeStatuses, _ := request.RetrieveBooleanQueryParameter(r, "summarizeStatuses", true)
-
 	edgeStacks, err := handler.DataStore.EdgeStack().EdgeStacks()
 	if err != nil {
 		return httperror.InternalServerError("Unable to retrieve edge stacks from the database", err)
 	}
 
-	res := make([]edgeStackListResponseItem, len(edgeStacks))
-
-	for i := range edgeStacks {
-		res[i].EdgeStack = edgeStacks[i]
-
-		if summarizeStatuses {
-			if err := fillStatusSummary(handler.DataStore, &res[i]); err != nil {
-				return handlerDBErr(err, "Unable to retrieve edge stack status from the database")
-			}
-		} else if err := fillEdgeStackStatus(handler.DataStore, &res[i].EdgeStack); err != nil {
-			return handlerDBErr(err, "Unable to retrieve edge stack status from the database")
-		}
-	}
-
-	return response.JSON(w, res)
-}
-
-func fillStatusSummary(tx dataservices.DataStoreTx, edgeStack *edgeStackListResponseItem) error {
-	statuses, err := tx.EdgeStackStatus().ReadAll(edgeStack.ID)
-	if err != nil {
-		return err
-	}
-
-	aggregated := make(aggregatedStatusesMap)
-
-	for _, envStatus := range statuses {
-		for _, status := range envStatus.Status {
-			aggregated[status.Type]++
-		}
-	}
-
-	status, reason := SummarizeStatuses(statuses, edgeStack.NumDeployments)
-
-	edgeStack.StatusSummary = edgeStackStatusSummary{
-		AggregatedStatus: aggregated,
-		Status:           status,
-		Reason:           reason,
-	}
-
-	edgeStack.Status = map[portainer.EndpointID]portainer.EdgeStackStatus{}
-
-	return nil
-}
-
-func SummarizeStatuses(statuses []portainer.EdgeStackStatusForEnv, numDeployments int) (SummarizedStatus, string) {
-	if numDeployments == 0 {
-		return sumStatusUnavailable, "Your edge stack is currently unavailable due to the absence of an available environment in your edge group"
-	}
-
-	allStatuses := slicesx.FlatMap(statuses, func(x portainer.EdgeStackStatusForEnv) []portainer.EdgeStackDeploymentStatus {
-		return x.Status
-	})
-
-	lastStatuses := slicesx.Map(
-		slicesx.Filter(
-			statuses,
-			func(s portainer.EdgeStackStatusForEnv) bool {
-				return len(s.Status) > 0
-			},
-		),
-		func(x portainer.EdgeStackStatusForEnv) portainer.EdgeStackDeploymentStatus {
-			return x.Status[len(x.Status)-1]
-		},
-	)
-
-	if len(lastStatuses) == 0 {
-		return sumStatusDeploying, ""
-	}
-
-	if allFailed := slicesx.Every(lastStatuses, func(s portainer.EdgeStackDeploymentStatus) bool {
-		return s.Type == portainer.EdgeStackStatusError
-	}); allFailed {
-		return sumStatusFailed, ""
-	}
-
-	if hasPaused := slicesx.Some(allStatuses, func(s portainer.EdgeStackDeploymentStatus) bool {
-		return s.Type == portainer.EdgeStackStatusPausedDeploying
-	}); hasPaused {
-		return sumStatusPaused, ""
-	}
-
-	if len(lastStatuses) < numDeployments {
-		return sumStatusDeploying, ""
-	}
-
-	hasDeploying := slicesx.Some(lastStatuses, func(s portainer.EdgeStackDeploymentStatus) bool { return s.Type == portainer.EdgeStackStatusDeploying })
-	hasRunning := slicesx.Some(lastStatuses, func(s portainer.EdgeStackDeploymentStatus) bool { return s.Type == portainer.EdgeStackStatusRunning })
-	hasFailed := slicesx.Some(lastStatuses, func(s portainer.EdgeStackDeploymentStatus) bool { return s.Type == portainer.EdgeStackStatusError })
-
-	if hasRunning && hasFailed && !hasDeploying {
-		return sumStatusPartiallyRunning, ""
-	}
-
-	if allCompleted := slicesx.Every(lastStatuses, func(s portainer.EdgeStackDeploymentStatus) bool { return s.Type == portainer.EdgeStackStatusCompleted }); allCompleted {
-		return sumStatusCompleted, ""
-	}
-
-	if allRunning := slicesx.Every(lastStatuses, func(s portainer.EdgeStackDeploymentStatus) bool {
-		return s.Type == portainer.EdgeStackStatusRunning
-	}); allRunning {
-		return sumStatusRunning, ""
-	}
-
-	return sumStatusDeploying, ""
+	return response.JSON(w, edgeStacks)
 }

api/http/handler/edgestacks/edgestack_status_update.go

@@ -9,10 +9,11 @@ import (
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
 )
 
 type updateStatusPayload struct {
@@ -77,25 +78,12 @@ func (handler *Handler) edgeStackStatusUpdate(w http.ResponseWriter, r *http.Req
 		return httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment name: %s", err, endpoint.Name))
 	}
 
-	var stack *portainer.EdgeStack
+	updateFn := func(stack *portainer.EdgeStack) (*portainer.EdgeStack, error) {
+		return handler.updateEdgeStackStatus(stack, stack.ID, payload)
+	}
 
-	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		var err error
-		stack, err = tx.EdgeStack().EdgeStack(portainer.EdgeStackID(stackID))
-		if err != nil {
-			if dataservices.IsErrObjectNotFound(err) {
-				return nil
-			}
-
-			return httperror.InternalServerError("Unable to retrieve Edge stack from the database", err)
-		}
-
-		if err := handler.updateEdgeStackStatus(tx, stack, stack.ID, payload); err != nil {
-			return httperror.InternalServerError("Unable to update Edge stack status", err)
-		}
-
-		return nil
-	}); err != nil {
+	stack, err := handler.stackCoordinator.UpdateStatus(r, portainer.EdgeStackID(stackID), updateFn)
+	if err != nil {
 		var httpErr *httperror.HandlerError
 		if errors.As(err, &httpErr) {
 			return httpErr
@@ -108,36 +96,43 @@ func (handler *Handler) edgeStackStatusUpdate(w http.ResponseWriter, r *http.Req
 		return nil
 	}
 
-	if err := fillEdgeStackStatus(handler.DataStore, stack); err != nil {
-		return handlerDBErr(err, "Unable to retrieve edge stack status from the database")
-	}
-
 	return response.JSON(w, stack)
 }
 
-func (handler *Handler) updateEdgeStackStatus(tx dataservices.DataStoreTx, stack *portainer.EdgeStack, stackID portainer.EdgeStackID, payload updateStatusPayload) error {
+func (handler *Handler) updateEdgeStackStatus(stack *portainer.EdgeStack, stackID portainer.EdgeStackID, payload updateStatusPayload) (*portainer.EdgeStack, error) {
 	if payload.Version > 0 && payload.Version < stack.Version {
-		return nil
+		return stack, nil
 	}
 
 	status := *payload.Status
 
+	log.Debug().
+		Int("stackID", int(stackID)).
+		Int("status", int(status)).
+		Msg("Updating stack status")
+
 	deploymentStatus := portainer.EdgeStackDeploymentStatus{
 		Type:  status,
 		Error: payload.Error,
 		Time:  payload.Time,
 	}
 
+	updateEnvStatus(payload.EndpointID, stack, deploymentStatus)
+
+	return stack, nil
+}
+
+func updateEnvStatus(environmentId portainer.EndpointID, stack *portainer.EdgeStack, deploymentStatus portainer.EdgeStackDeploymentStatus) {
 	if deploymentStatus.Type == portainer.EdgeStackStatusRemoved {
-		return tx.EdgeStackStatus().Delete(stackID, payload.EndpointID)
+		delete(stack.Status, environmentId)
+
+		return
 	}
 
-	environmentStatus, err := tx.EdgeStackStatus().Read(stackID, payload.EndpointID)
-	if err != nil && !tx.IsErrObjectNotFound(err) {
-		return err
-	} else if tx.IsErrObjectNotFound(err) {
-		environmentStatus = &portainer.EdgeStackStatusForEnv{
-			EndpointID: payload.EndpointID,
+	environmentStatus, ok := stack.Status[environmentId]
+	if !ok {
+		environmentStatus = portainer.EdgeStackStatus{
+			EndpointID: environmentId,
 			Status:     []portainer.EdgeStackDeploymentStatus{},
 		}
 	}
@@ -148,5 +143,5 @@ func (handler *Handler) updateEdgeStackStatus(tx dataservices.DataStoreTx, stack
 		environmentStatus.Status = append(environmentStatus.Status, deploymentStatus)
 	}
 
-	return tx.EdgeStackStatus().Update(stackID, payload.EndpointID, environmentStatus)
+	stack.Status[environmentId] = environmentStatus
 }

api/http/handler/edgestacks/edgestack_status_update_coordinator.go

@@ -0,0 +1,155 @@
+package edgestacks
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+
+	"github.com/rs/zerolog/log"
+)
+
+type statusRequest struct {
+	respCh   chan statusResponse
+	stackID  portainer.EdgeStackID
+	updateFn statusUpdateFn
+}
+
+type statusResponse struct {
+	Stack *portainer.EdgeStack
+	Error error
+}
+
+type statusUpdateFn func(*portainer.EdgeStack) (*portainer.EdgeStack, error)
+
+type EdgeStackStatusUpdateCoordinator struct {
+	updateCh  chan statusRequest
+	dataStore dataservices.DataStore
+}
+
+var errAnotherStackUpdateInProgress = errors.New("another stack update is in progress")
+
+func NewEdgeStackStatusUpdateCoordinator(dataStore dataservices.DataStore) *EdgeStackStatusUpdateCoordinator {
+	return &EdgeStackStatusUpdateCoordinator{
+		updateCh:  make(chan statusRequest),
+		dataStore: dataStore,
+	}
+}
+
+func (c *EdgeStackStatusUpdateCoordinator) Start() {
+	for {
+		c.loop()
+	}
+}
+
+func (c *EdgeStackStatusUpdateCoordinator) loop() {
+	u := <-c.updateCh
+
+	respChs := []chan statusResponse{u.respCh}
+
+	var stack *portainer.EdgeStack
+
+	err := c.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		// 1. Load the edge stack
+		var err error
+
+		stack, err = loadEdgeStack(tx, u.stackID)
+		if err != nil {
+			return err
+		}
+
+		// Return early when the agent tries to update the status on a deleted stack
+		if stack == nil {
+			return nil
+		}
+
+		// 2. Mutate the edge stack opportunistically until there are no more pending updates
+		for {
+			stack, err = u.updateFn(stack)
+			if err != nil {
+				return err
+			}
+
+			if m, ok := c.getNextUpdate(stack.ID); ok {
+				u = m
+			} else {
+				break
+			}
+
+			respChs = append(respChs, u.respCh)
+		}
+
+		// 3. Save the changes back to the database
+		if err := tx.EdgeStack().UpdateEdgeStack(stack.ID, stack); err != nil {
+			return handlerDBErr(fmt.Errorf("unable to update Edge stack: %w.", err), "Unable to persist the stack changes inside the database")
+		}
+
+		return nil
+	})
+
+	// 4. Send back the responses
+	for _, ch := range respChs {
+		ch <- statusResponse{Stack: stack, Error: err}
+	}
+}
+
+func loadEdgeStack(tx dataservices.DataStoreTx, stackID portainer.EdgeStackID) (*portainer.EdgeStack, error) {
+	stack, err := tx.EdgeStack().EdgeStack(stackID)
+	if err != nil {
+		if dataservices.IsErrObjectNotFound(err) {
+			// Skip the error when the agent tries to update the status on a deleted stack
+			log.Debug().
+				Err(err).
+				Int("stackID", int(stackID)).
+				Msg("Unable to find a stack inside the database, skipping error")
+
+			return nil, nil
+		}
+
+		return nil, fmt.Errorf("unable to retrieve Edge stack from the database: %w.", err)
+	}
+
+	return stack, nil
+}
+
+func (c *EdgeStackStatusUpdateCoordinator) getNextUpdate(stackID portainer.EdgeStackID) (statusRequest, bool) {
+	for {
+		select {
+		case u := <-c.updateCh:
+			// Discard the update and let the agent retry
+			if u.stackID != stackID {
+				u.respCh <- statusResponse{Error: errAnotherStackUpdateInProgress}
+
+				continue
+			}
+
+			return u, true
+
+		default:
+			return statusRequest{}, false
+		}
+	}
+}
+
+func (c *EdgeStackStatusUpdateCoordinator) UpdateStatus(r *http.Request, stackID portainer.EdgeStackID, updateFn statusUpdateFn) (*portainer.EdgeStack, error) {
+	respCh := make(chan statusResponse)
+	defer close(respCh)
+
+	msg := statusRequest{
+		respCh:   respCh,
+		stackID:  stackID,
+		updateFn: updateFn,
+	}
+
+	select {
+	case c.updateCh <- msg:
+		r := <-respCh
+
+		return r.Stack, r.Error
+
+	case <-r.Context().Done():
+		return nil, r.Context().Err()
+	}
+}

api/http/handler/edgestacks/edgestack_status_update_test.go

@@ -10,7 +10,6 @@ import (
 	portainer "github.com/portainer/portainer/api"
 
 	"github.com/segmentio/encoding/json"
-	"github.com/stretchr/testify/require"
 )
 
 // Update Status
@@ -29,11 +28,15 @@ func TestUpdateStatusAndInspect(t *testing.T) {
 	}
 
 	jsonPayload, err := json.Marshal(payload)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
 
 	r := bytes.NewBuffer(jsonPayload)
 	req, err := http.NewRequest(http.MethodPut, fmt.Sprintf("/edge_stacks/%d/status", edgeStack.ID), r)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
 
 	req.Header.Set(portainer.PortainerAgentEdgeIDHeader, endpoint.EdgeID)
 	rec := httptest.NewRecorder()
@@ -45,7 +48,9 @@ func TestUpdateStatusAndInspect(t *testing.T) {
 
 	// Get updated edge stack
 	req, err = http.NewRequest(http.MethodGet, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), nil)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
 
 	req.Header.Add("x-api-key", rawAPIKey)
 	rec = httptest.NewRecorder()
@@ -57,10 +62,14 @@ func TestUpdateStatusAndInspect(t *testing.T) {
 
 	updatedStack := portainer.EdgeStack{}
 	err = json.NewDecoder(rec.Body).Decode(&updatedStack)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("error decoding response:", err)
+	}
 
 	endpointStatus, ok := updatedStack.Status[payload.EndpointID]
-	require.True(t, ok)
+	if !ok {
+		t.Fatal("Missing status")
+	}
 
 	lastStatus := endpointStatus.Status[len(endpointStatus.Status)-1]
 
@@ -75,8 +84,8 @@ func TestUpdateStatusAndInspect(t *testing.T) {
 	if endpointStatus.EndpointID != payload.EndpointID {
 		t.Fatalf("expected EndpointID %d, found %d", payload.EndpointID, endpointStatus.EndpointID)
 	}
-}
 
+}
 func TestUpdateStatusWithInvalidPayload(t *testing.T) {
 	handler, _ := setupHandler(t)
 
@@ -127,11 +136,15 @@ func TestUpdateStatusWithInvalidPayload(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.Name, func(t *testing.T) {
 			jsonPayload, err := json.Marshal(tc.Payload)
-			require.NoError(t, err)
+			if err != nil {
+				t.Fatal("request error:", err)
+			}
 
 			r := bytes.NewBuffer(jsonPayload)
 			req, err := http.NewRequest(http.MethodPut, fmt.Sprintf("/edge_stacks/%d/status", edgeStack.ID), r)
-			require.NoError(t, err)
+			if err != nil {
+				t.Fatal("request error:", err)
+			}
 
 			req.Header.Set(portainer.PortainerAgentEdgeIDHeader, endpoint.EdgeID)
 			rec := httptest.NewRecorder()

api/http/handler/edgestacks/edgestack_test.go

@@ -17,7 +17,6 @@ import (
 	"github.com/portainer/portainer/api/jwt"
 
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/require"
 )
 
 // Helpers
@@ -52,21 +51,27 @@ func setupHandler(t *testing.T) (*Handler, string) {
 		t.Fatal(err)
 	}
 
+	coord := NewEdgeStackStatusUpdateCoordinator(store)
+	go coord.Start()
+
 	handler := NewHandler(
 		security.NewRequestBouncer(store, jwtService, apiKeyService),
 		store,
 		edgestacks.NewService(store),
+		coord,
 	)
 
 	handler.FileService = fs
 
 	settings, err := handler.DataStore.Settings().Settings()
-	require.NoError(t, err)
-
+	if err != nil {
+		t.Fatal(err)
+	}
 	settings.EnableEdgeComputeFeatures = true
 
-	err = handler.DataStore.Settings().UpdateSettings(settings)
-	require.NoError(t, err)
+	if err := handler.DataStore.Settings().UpdateSettings(settings); err != nil {
+		t.Fatal(err)
+	}
 
 	handler.GitService = testhelpers.NewGitService(errors.New("Clone error"), "git-service-id")
 
@@ -85,8 +90,9 @@ func createEndpointWithId(t *testing.T, store dataservices.DataStore, endpointID
 		LastCheckInDate: time.Now().Unix(),
 	}
 
-	err := store.Endpoint().Create(&endpoint)
-	require.NoError(t, err)
+	if err := store.Endpoint().Create(&endpoint); err != nil {
+		t.Fatal(err)
+	}
 
 	return endpoint
 }
@@ -107,13 +113,15 @@ func createEdgeStack(t *testing.T, store dataservices.DataStore, endpointID port
 		PartialMatch: false,
 	}
 
-	err := store.EdgeGroup().Create(&edgeGroup)
-	require.NoError(t, err)
+	if err := store.EdgeGroup().Create(&edgeGroup); err != nil {
+		t.Fatal(err)
+	}
 
 	edgeStackID := portainer.EdgeStackID(14)
 	edgeStack := portainer.EdgeStack{
 		ID:             edgeStackID,
 		Name:           "test-edge-stack-" + strconv.Itoa(int(edgeStackID)),
+		Status:         map[portainer.EndpointID]portainer.EdgeStackStatus{},
 		CreationDate:   time.Now().Unix(),
 		EdgeGroups:     []portainer.EdgeGroupID{edgeGroup.ID},
 		ProjectPath:    "/project/path",
@@ -130,11 +138,13 @@ func createEdgeStack(t *testing.T, store dataservices.DataStore, endpointID port
 		},
 	}
 
-	err = store.EdgeStack().Create(edgeStack.ID, &edgeStack)
-	require.NoError(t, err)
+	if err := store.EdgeStack().Create(edgeStack.ID, &edgeStack); err != nil {
+		t.Fatal(err)
+	}
 
-	err = store.EndpointRelation().Create(&endpointRelation)
-	require.NoError(t, err)
+	if err := store.EndpointRelation().Create(&endpointRelation); err != nil {
+		t.Fatal(err)
+	}
 
 	return edgeStack
 }
@@ -145,8 +155,8 @@ func createEdgeGroup(t *testing.T, store dataservices.DataStore) portainer.EdgeG
 		Name: "EdgeGroup 1",
 	}
 
-	err := store.EdgeGroup().Create(&edgeGroup)
-	require.NoError(t, err)
-
+	if err := store.EdgeGroup().Create(&edgeGroup); err != nil {
+		t.Fatal(err)
+	}
 	return edgeGroup
 }

api/http/handler/edgestacks/edgestack_update.go

@@ -74,10 +74,6 @@ func (handler *Handler) edgeStackUpdate(w http.ResponseWriter, r *http.Request)
 		return httperror.InternalServerError("Unexpected error", err)
 	}
 
-	if err := fillEdgeStackStatus(handler.DataStore, stack); err != nil {
-		return handlerDBErr(err, "Unable to retrieve edge stack status from the database")
-	}
-
 	return response.JSON(w, stack)
 }
 
@@ -124,7 +120,7 @@ func (handler *Handler) updateEdgeStack(tx dataservices.DataStoreTx, stackID por
 	stack.EdgeGroups = groupsIds
 
 	if payload.UpdateVersion {
-		if err := handler.updateStackVersion(tx, stack, payload.DeploymentType, []byte(payload.StackFileContent), "", relatedEndpointIds); err != nil {
+		if err := handler.updateStackVersion(stack, payload.DeploymentType, []byte(payload.StackFileContent), "", relatedEndpointIds); err != nil {
 			return nil, httperror.InternalServerError("Unable to update stack version", err)
 		}
 	}

api/http/handler/edgestacks/edgestack_update_test.go

@@ -25,8 +25,9 @@ func TestUpdateAndInspect(t *testing.T) {
 	endpointID := portainer.EndpointID(6)
 	newEndpoint := createEndpointWithId(t, handler.DataStore, endpointID)
 
-	err := handler.DataStore.Endpoint().Create(&newEndpoint)
-	require.NoError(t, err)
+	if err := handler.DataStore.Endpoint().Create(&newEndpoint); err != nil {
+		t.Fatal(err)
+	}
 
 	endpointRelation := portainer.EndpointRelation{
 		EndpointID: endpointID,
@@ -35,8 +36,9 @@ func TestUpdateAndInspect(t *testing.T) {
 		},
 	}
 
-	err = handler.DataStore.EndpointRelation().Create(&endpointRelation)
-	require.NoError(t, err)
+	if err := handler.DataStore.EndpointRelation().Create(&endpointRelation); err != nil {
+		t.Fatal(err)
+	}
 
 	newEdgeGroup := portainer.EdgeGroup{
 		ID:           2,
@@ -47,8 +49,9 @@ func TestUpdateAndInspect(t *testing.T) {
 		PartialMatch: false,
 	}
 
-	err = handler.DataStore.EdgeGroup().Create(&newEdgeGroup)
-	require.NoError(t, err)
+	if err := handler.DataStore.EdgeGroup().Create(&newEdgeGroup); err != nil {
+		t.Fatal(err)
+	}
 
 	payload := updateEdgeStackPayload{
 		StackFileContent: "update-test",
@@ -58,11 +61,15 @@ func TestUpdateAndInspect(t *testing.T) {
 	}
 
 	jsonPayload, err := json.Marshal(payload)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
 
 	r := bytes.NewBuffer(jsonPayload)
 	req, err := http.NewRequest(http.MethodPut, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), r)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
 
 	req.Header.Add("x-api-key", rawAPIKey)
 	rec := httptest.NewRecorder()
@@ -74,7 +81,9 @@ func TestUpdateAndInspect(t *testing.T) {
 
 	// Get updated edge stack
 	req, err = http.NewRequest(http.MethodGet, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), nil)
-	require.NoError(t, err)
+	if err != nil {
+		t.Fatal("request error:", err)
+	}
 
 	req.Header.Add("x-api-key", rawAPIKey)
 	rec = httptest.NewRecorder()
@@ -85,8 +94,9 @@ func TestUpdateAndInspect(t *testing.T) {
 	}
 
 	updatedStack := portainer.EdgeStack{}
-	err = json.NewDecoder(rec.Body).Decode(&updatedStack)
-	require.NoError(t, err)
+	if err := json.NewDecoder(rec.Body).Decode(&updatedStack); err != nil {
+		t.Fatal("error decoding response:", err)
+	}
 
 	if payload.UpdateVersion && updatedStack.Version != edgeStack.Version+1 {
 		t.Fatalf("expected EdgeStack version %d, found %d", edgeStack.Version+1, updatedStack.Version+1)
@@ -216,11 +226,15 @@ func TestUpdateWithInvalidPayload(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.Name, func(t *testing.T) {
 			jsonPayload, err := json.Marshal(tc.Payload)
-			require.NoError(t, err)
+			if err != nil {
+				t.Fatal("request error:", err)
+			}
 
 			r := bytes.NewBuffer(jsonPayload)
 			req, err := http.NewRequest(http.MethodPut, fmt.Sprintf("/edge_stacks/%d", edgeStack.ID), r)
-			require.NoError(t, err)
+			if err != nil {
+				t.Fatal("request error:", err)
+			}
 
 			req.Header.Add("x-api-key", rawAPIKey)
 			rec := httptest.NewRecorder()

api/http/handler/edgestacks/handler.go

@@ -22,15 +22,17 @@ type Handler struct {
 	GitService         portainer.GitService
 	edgeStacksService  *edgestackservice.Service
 	KubernetesDeployer portainer.KubernetesDeployer
+	stackCoordinator   *EdgeStackStatusUpdateCoordinator
 }
 
 // NewHandler creates a handler to manage environment(endpoint) group operations.
-func NewHandler(bouncer security.BouncerService, dataStore dataservices.DataStore, edgeStacksService *edgestackservice.Service) *Handler {
+func NewHandler(bouncer security.BouncerService, dataStore dataservices.DataStore, edgeStacksService *edgestackservice.Service, stackCoordinator *EdgeStackStatusUpdateCoordinator) *Handler {
 	h := &Handler{
 		Router:            mux.NewRouter(),
 		requestBouncer:    bouncer,
 		DataStore:         dataStore,
 		edgeStacksService: edgeStacksService,
+		stackCoordinator:  stackCoordinator,
 	}
 
 	h.Handle("/edge_stacks/create/{method}",

api/http/handler/edgestacks/utils_update_stack_version.go

@@ -5,18 +5,15 @@ import (
 	"strconv"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/filesystem"
+	edgestackutils "github.com/portainer/portainer/api/internal/edge/edgestacks"
 
 	"github.com/rs/zerolog/log"
 )
 
-func (handler *Handler) updateStackVersion(tx dataservices.DataStoreTx, stack *portainer.EdgeStack, deploymentType portainer.EdgeStackDeploymentType, config []byte, oldGitHash string, relatedEnvironmentsIDs []portainer.EndpointID) error {
-	stack.Version++
-
-	if err := tx.EdgeStackStatus().Clear(stack.ID, relatedEnvironmentsIDs); err != nil {
-		return err
-	}
+func (handler *Handler) updateStackVersion(stack *portainer.EdgeStack, deploymentType portainer.EdgeStackDeploymentType, config []byte, oldGitHash string, relatedEnvironmentsIDs []portainer.EndpointID) error {
+	stack.Version = stack.Version + 1
+	stack.Status = edgestackutils.NewStatus(stack.Status, relatedEnvironmentsIDs)
 
 	return handler.storeStackFile(stack, deploymentType, config)
 }

api/http/handler/endpointedge/endpointedge_status_inspect.go

@@ -264,6 +264,9 @@ func (handler *Handler) buildSchedules(tx dataservices.DataStoreTx, endpointID p
 func (handler *Handler) buildEdgeStacks(tx dataservices.DataStoreTx, endpointID portainer.EndpointID) ([]stackStatusResponse, *httperror.HandlerError) {
 	relation, err := tx.EndpointRelation().EndpointRelation(endpointID)
 	if err != nil {
+		if tx.IsErrObjectNotFound(err) {
+			return nil, nil
+		}
 		return nil, httperror.InternalServerError("Unable to retrieve relation object from the database", err)
 	}
 

api/http/handler/endpointedge/endpointedge_status_inspect_test.go

@@ -287,8 +287,11 @@ func TestEdgeStackStatus(t *testing.T) {
 
 	edgeStackID := portainer.EdgeStackID(17)
 	edgeStack := portainer.EdgeStack{
-		ID:             edgeStackID,
-		Name:           "test-edge-stack-17",
+		ID:   edgeStackID,
+		Name: "test-edge-stack-17",
+		Status: map[portainer.EndpointID]portainer.EdgeStackStatus{
+			endpointID: {},
+		},
 		CreationDate:   time.Now().Unix(),
 		EdgeGroups:     []portainer.EdgeGroupID{1, 2},
 		ProjectPath:    "/project/path",

api/http/handler/endpointgroups/endpoints.go

@@ -21,10 +21,17 @@ func (handler *Handler) updateEndpointRelations(tx dataservices.DataStoreTx, end
 	}
 
 	endpointRelation, err := tx.EndpointRelation().EndpointRelation(endpoint.ID)
-	if err != nil {
+	if err != nil && !tx.IsErrObjectNotFound(err) {
 		return err
 	}
 
+	if endpointRelation == nil {
+		endpointRelation = &portainer.EndpointRelation{
+			EndpointID: endpoint.ID,
+			EdgeStacks: make(map[portainer.EdgeStackID]bool),
+		}
+	}
+
 	edgeGroups, err := tx.EdgeGroup().ReadAll()
 	if err != nil {
 		return err

api/http/handler/endpoints/endpoint_create.go

@@ -563,10 +563,6 @@ func (handler *Handler) saveEndpointAndUpdateAuthorizations(tx dataservices.Data
 		return err
 	}
 
-	if err := endpointutils.InitializeEdgeEndpointRelation(endpoint, tx); err != nil {
-		return err
-	}
-
 	for _, tagID := range endpoint.TagIDs {
 		if err := tx.Tag().UpdateTagFunc(tagID, func(tag *portainer.Tag) {
 			tag.Endpoints[endpoint.ID] = true

api/http/handler/endpoints/endpoint_delete.go

@@ -214,9 +214,14 @@ func (handler *Handler) deleteEndpoint(tx dataservices.DataStoreTx, endpointID p
 		log.Warn().Err(err).Msg("Unable to retrieve edge stacks from the database")
 	}
 
-	for _, edgeStack := range edgeStacks {
-		if err := tx.EdgeStackStatus().Delete(edgeStack.ID, endpoint.ID); err != nil {
-			log.Warn().Err(err).Msg("Unable to delete edge stack status")
+	for idx := range edgeStacks {
+		edgeStack := &edgeStacks[idx]
+		if _, ok := edgeStack.Status[endpoint.ID]; ok {
+			delete(edgeStack.Status, endpoint.ID)
+
+			if err := tx.EdgeStack().UpdateEdgeStack(edgeStack.ID, edgeStack); err != nil {
+				log.Warn().Err(err).Msg("Unable to update edge stack")
+			}
 		}
 	}
 

api/http/handler/endpoints/endpoint_list.go

@@ -95,11 +95,12 @@ func (handler *Handler) endpointList(w http.ResponseWriter, r *http.Request) *ht
 		return httperror.BadRequest("Invalid query parameters", err)
 	}
 
-	filteredEndpoints, totalAvailableEndpoints, err := handler.filterEndpointsByQuery(endpoints, query, endpointGroups, edgeGroups, settings, securityContext)
+	filteredEndpoints := security.FilterEndpoints(endpoints, endpointGroups, securityContext)
+
+	filteredEndpoints, totalAvailableEndpoints, err := handler.filterEndpointsByQuery(filteredEndpoints, query, endpointGroups, edgeGroups, settings)
 	if err != nil {
 		return httperror.InternalServerError("Unable to filter endpoints", err)
 	}
-	filteredEndpoints = security.FilterEndpoints(filteredEndpoints, endpointGroups, securityContext)
 
 	sortEnvironmentsByField(filteredEndpoints, endpointGroups, getSortKey(sortField), sortOrder == "desc")
 

api/http/handler/endpoints/endpoint_registries_list.go

@@ -75,7 +75,7 @@ func (handler *Handler) listRegistries(tx dataservices.DataStoreTx, r *http.Requ
 		return nil, httperror.InternalServerError("Unable to retrieve registries from the database", err)
 	}
 
-	registries, handleError := handler.filterRegistriesByAccess(tx, r, registries, endpoint, user, securityContext.UserMemberships)
+	registries, handleError := handler.filterRegistriesByAccess(r, registries, endpoint, user, securityContext.UserMemberships)
 	if handleError != nil {
 		return nil, handleError
 	}
@@ -87,15 +87,15 @@ func (handler *Handler) listRegistries(tx dataservices.DataStoreTx, r *http.Requ
 	return registries, err
 }
 
-func (handler *Handler) filterRegistriesByAccess(tx dataservices.DataStoreTx, r *http.Request, registries []portainer.Registry, endpoint *portainer.Endpoint, user *portainer.User, memberships []portainer.TeamMembership) ([]portainer.Registry, *httperror.HandlerError) {
+func (handler *Handler) filterRegistriesByAccess(r *http.Request, registries []portainer.Registry, endpoint *portainer.Endpoint, user *portainer.User, memberships []portainer.TeamMembership) ([]portainer.Registry, *httperror.HandlerError) {
 	if !endpointutils.IsKubernetesEndpoint(endpoint) {
 		return security.FilterRegistries(registries, user, memberships, endpoint.ID), nil
 	}
 
-	return handler.filterKubernetesEndpointRegistries(tx, r, registries, endpoint, user, memberships)
+	return handler.filterKubernetesEndpointRegistries(r, registries, endpoint, user, memberships)
 }
 
-func (handler *Handler) filterKubernetesEndpointRegistries(tx dataservices.DataStoreTx, r *http.Request, registries []portainer.Registry, endpoint *portainer.Endpoint, user *portainer.User, memberships []portainer.TeamMembership) ([]portainer.Registry, *httperror.HandlerError) {
+func (handler *Handler) filterKubernetesEndpointRegistries(r *http.Request, registries []portainer.Registry, endpoint *portainer.Endpoint, user *portainer.User, memberships []portainer.TeamMembership) ([]portainer.Registry, *httperror.HandlerError) {
 	namespaceParam, _ := request.RetrieveQueryParameter(r, "namespace", true)
 	isAdmin, err := security.IsAdmin(r)
 	if err != nil {
@@ -116,7 +116,7 @@ func (handler *Handler) filterKubernetesEndpointRegistries(tx dataservices.DataS
 		return registries, nil
 	}
 
-	return handler.filterKubernetesRegistriesByUserRole(tx, r, registries, endpoint, user)
+	return handler.filterKubernetesRegistriesByUserRole(r, registries, endpoint, user)
 }
 
 func (handler *Handler) isNamespaceAuthorized(endpoint *portainer.Endpoint, namespace string, userId portainer.UserID, memberships []portainer.TeamMembership, isAdmin bool) (bool, error) {
@@ -169,7 +169,7 @@ func registryAccessPoliciesContainsNamespace(registryAccess portainer.RegistryAc
 	return false
 }
 
-func (handler *Handler) filterKubernetesRegistriesByUserRole(tx dataservices.DataStoreTx, r *http.Request, registries []portainer.Registry, endpoint *portainer.Endpoint, user *portainer.User) ([]portainer.Registry, *httperror.HandlerError) {
+func (handler *Handler) filterKubernetesRegistriesByUserRole(r *http.Request, registries []portainer.Registry, endpoint *portainer.Endpoint, user *portainer.User) ([]portainer.Registry, *httperror.HandlerError) {
 	err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
 	if errors.Is(err, security.ErrAuthorizationRequired) {
 		return nil, httperror.Forbidden("User is not authorized", err)
@@ -178,7 +178,7 @@ func (handler *Handler) filterKubernetesRegistriesByUserRole(tx dataservices.Dat
 		return nil, httperror.InternalServerError("Unable to retrieve info from request context", err)
 	}
 
-	userNamespaces, err := handler.userNamespaces(tx, endpoint, user)
+	userNamespaces, err := handler.userNamespaces(endpoint, user)
 	if err != nil {
 		return nil, httperror.InternalServerError("unable to retrieve user namespaces", err)
 	}
@@ -186,7 +186,7 @@ func (handler *Handler) filterKubernetesRegistriesByUserRole(tx dataservices.Dat
 	return filterRegistriesByNamespaces(registries, endpoint.ID, userNamespaces), nil
 }
 
-func (handler *Handler) userNamespaces(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint, user *portainer.User) ([]string, error) {
+func (handler *Handler) userNamespaces(endpoint *portainer.Endpoint, user *portainer.User) ([]string, error) {
 	kcl, err := handler.K8sClientFactory.GetPrivilegedKubeClient(endpoint)
 	if err != nil {
 		return nil, err
@@ -197,7 +197,7 @@ func (handler *Handler) userNamespaces(tx dataservices.DataStoreTx, endpoint *po
 		return nil, err
 	}
 
-	userMemberships, err := tx.TeamMembership().TeamMembershipsByUserID(user.ID)
+	userMemberships, err := handler.DataStore.TeamMembership().TeamMembershipsByUserID(user.ID)
 	if err != nil {
 		return nil, err
 	}

api/http/handler/endpoints/filter.go

@@ -11,7 +11,6 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/http/handler/edgegroups"
-	"github.com/portainer/portainer/api/http/security"
 	"github.com/portainer/portainer/api/internal/edge"
 	"github.com/portainer/portainer/api/internal/endpointutils"
 	"github.com/portainer/portainer/api/slicesx"
@@ -141,7 +140,6 @@ func (handler *Handler) filterEndpointsByQuery(
 	groups []portainer.EndpointGroup,
 	edgeGroups []portainer.EdgeGroup,
 	settings *portainer.Settings,
-	context *security.RestrictedRequestContext,
 ) ([]portainer.Endpoint, int, error) {
 	totalAvailableEndpoints := len(filteredEndpoints)
 
@@ -183,16 +181,11 @@ func (handler *Handler) filterEndpointsByQuery(
 	}
 
 	// filter edge environments by trusted/untrusted
-	// only portainer admins are allowed to see untrusted environments
 	filteredEndpoints = filter(filteredEndpoints, func(endpoint portainer.Endpoint) bool {
 		if !endpointutils.IsEdgeEndpoint(&endpoint) {
 			return true
 		}
 
-		if query.edgeDeviceUntrusted {
-			return !endpoint.UserTrusted && context.IsAdmin
-		}
-
 		return endpoint.UserTrusted == !query.edgeDeviceUntrusted
 	})
 
@@ -254,17 +247,19 @@ func (handler *Handler) filterEndpointsByQuery(
 	return filteredEndpoints, totalAvailableEndpoints, nil
 }
 
-func endpointStatusInStackMatchesFilter(stackStatus *portainer.EdgeStackStatusForEnv, envId portainer.EndpointID, statusFilter portainer.EdgeStackStatusType) bool {
+func endpointStatusInStackMatchesFilter(edgeStackStatus map[portainer.EndpointID]portainer.EdgeStackStatus, envId portainer.EndpointID, statusFilter portainer.EdgeStackStatusType) bool {
+	status, ok := edgeStackStatus[envId]
+
 	// consider that if the env has no status in the stack it is in Pending state
 	if statusFilter == portainer.EdgeStackStatusPending {
-		return stackStatus == nil || len(stackStatus.Status) == 0
+		return !ok || len(status.Status) == 0
 	}
 
-	if stackStatus == nil {
+	if !ok {
 		return false
 	}
 
-	return slices.ContainsFunc(stackStatus.Status, func(s portainer.EdgeStackDeploymentStatus) bool {
+	return slices.ContainsFunc(status.Status, func(s portainer.EdgeStackDeploymentStatus) bool {
 		return s.Type == statusFilter
 	})
 }
@@ -296,14 +291,7 @@ func filterEndpointsByEdgeStack(endpoints []portainer.Endpoint, edgeStackId port
 	if statusFilter != nil {
 		n := 0
 		for _, envId := range envIds {
-			edgeStackStatus, err := datastore.EdgeStackStatus().Read(edgeStackId, envId)
-			if dataservices.IsErrObjectNotFound(err) {
-				continue
-			} else if err != nil {
-				return nil, errors.WithMessagef(err, "Unable to retrieve edge stack status for environment %d", envId)
-			}
-
-			if endpointStatusInStackMatchesFilter(edgeStackStatus, envId, *statusFilter) {
+			if endpointStatusInStackMatchesFilter(stack.Status, envId, *statusFilter) {
 				envIds[n] = envId
 				n++
 			}

api/http/handler/endpoints/filter_test.go

@@ -6,7 +6,6 @@ import (
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/api/http/security"
 	"github.com/portainer/portainer/api/internal/testhelpers"
 	"github.com/portainer/portainer/api/slicesx"
 
@@ -264,7 +263,6 @@ func runTest(t *testing.T, test filterTest, handler *Handler, endpoints []portai
 		[]portainer.EndpointGroup{},
 		[]portainer.EdgeGroup{},
 		&portainer.Settings{},
-		&security.RestrictedRequestContext{IsAdmin: true},
 	)
 
 	is.NoError(err)

api/http/handler/endpoints/update_edge_relations.go

@@ -17,7 +17,17 @@ func (handler *Handler) updateEdgeRelations(tx dataservices.DataStoreTx, endpoin
 
 	relation, err := tx.EndpointRelation().EndpointRelation(endpoint.ID)
 	if err != nil {
-		return errors.WithMessage(err, "Unable to retrieve environment relation inside the database")
+		if !tx.IsErrObjectNotFound(err) {
+			return errors.WithMessage(err, "Unable to retrieve environment relation inside the database")
+		}
+
+		relation = &portainer.EndpointRelation{
+			EndpointID: endpoint.ID,
+			EdgeStacks: map[portainer.EdgeStackID]bool{},
+		}
+		if err := tx.EndpointRelation().Create(relation); err != nil {
+			return errors.WithMessage(err, "Unable to create environment relation inside the database")
+		}
 	}
 
 	endpointGroup, err := tx.EndpointGroup().Read(endpoint.GroupID)

api/http/handler/file/handler.go

@@ -17,12 +17,12 @@ type Handler struct {
 }
 
 // NewHandler creates a handler to serve static files.
-func NewHandler(assetPublicPath string, csp bool, wasInstanceDisabled func() bool) *Handler {
+func NewHandler(assetPublicPath string, wasInstanceDisabled func() bool) *Handler {
 	h := &Handler{
 		Handler: security.MWSecureHeaders(
 			gzhttp.GzipHandler(http.FileServer(http.Dir(assetPublicPath))),
 			featureflags.IsEnabled("hsts"),
-			csp,
+			featureflags.IsEnabled("csp"),
 		),
 		wasInstanceDisabled: wasInstanceDisabled,
 	}
@@ -36,7 +36,6 @@ func isHTML(acceptContent []string) bool {
 			return true
 		}
 	}
-
 	return false
 }
 
@@ -44,13 +43,11 @@ func (handler *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if handler.wasInstanceDisabled() {
 		if r.RequestURI == "/" || r.RequestURI == "/index.html" {
 			http.Redirect(w, r, "/timeout.html", http.StatusTemporaryRedirect)
-
 			return
 		}
 	} else {
 		if strings.HasPrefix(r.RequestURI, "/timeout.html") {
 			http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
-
 			return
 		}
 	}

api/http/handler/gitops/git_repo_file_preview.go

@@ -9,7 +9,8 @@ import (
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
-	"github.com/portainer/portainer/pkg/validate"
+
+	"github.com/asaskevich/govalidator"
 )
 
 type fileResponse struct {
@@ -28,7 +29,7 @@ type repositoryFilePreviewPayload struct {
 }
 
 func (payload *repositoryFilePreviewPayload) Validate(r *http.Request) error {
-	if len(payload.Repository) == 0 || !validate.IsURL(payload.Repository) {
+	if len(payload.Repository) == 0 || !govalidator.IsURL(payload.Repository) {
 		return errors.New("invalid repository URL. Must correspond to a valid URL format")
 	}
 

api/http/handler/handler.go

@@ -81,7 +81,7 @@ type Handler struct {
 }
 
 // @title PortainerCE API
-// @version 2.32.0
+// @version 2.29.1
 // @description.markdown api-description.md
 // @termsOfService
 

api/http/handler/helm/handler.go

@@ -62,10 +62,6 @@ func NewHandler(bouncer security.BouncerService, dataStore dataservices.DataStor
 	h.Handle("/{id}/kubernetes/helm/{release}/history",
 		httperror.LoggerHandler(h.helmGetHistory)).Methods(http.MethodGet)
 
-	// `helm rollback [RELEASE_NAME] [REVISION]`
-	h.Handle("/{id}/kubernetes/helm/{release}/rollback",
-		httperror.LoggerHandler(h.helmRollback)).Methods(http.MethodPost)
-
 	return h
 }
 

api/http/handler/helm/helm_install.go

@@ -26,8 +26,6 @@ type installChartPayload struct {
 	Chart     string `json:"chart"`
 	Repo      string `json:"repo"`
 	Values    string `json:"values"`
-	Version   string `json:"version"`
-	Atomic    bool   `json:"atomic"`
 }
 
 var errChartNameInvalid = errors.New("invalid chart name. " +
@@ -46,24 +44,18 @@ var errChartNameInvalid = errors.New("invalid chart name. " +
 // @produce json
 // @param id path int true "Environment(Endpoint) identifier"
 // @param payload body installChartPayload true "Chart details"
-// @param dryRun query bool false "Dry run"
 // @success 201 {object} release.Release "Created"
 // @failure 401 "Unauthorized"
 // @failure 404 "Environment(Endpoint) or ServiceAccount not found"
 // @failure 500 "Server error"
 // @router /endpoints/{id}/kubernetes/helm [post]
 func (handler *Handler) helmInstall(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
-	dryRun, err := request.RetrieveBooleanQueryParameter(r, "dryRun", true)
-	if err != nil {
-		return httperror.BadRequest("Invalid dryRun query parameter", err)
-	}
-
 	var payload installChartPayload
 	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
 		return httperror.BadRequest("Invalid Helm install payload", err)
 	}
 
-	release, err := handler.installChart(r, payload, dryRun)
+	release, err := handler.installChart(r, payload)
 	if err != nil {
 		return httperror.InternalServerError("Unable to install a chart", err)
 	}
@@ -100,7 +92,7 @@ func (p *installChartPayload) Validate(_ *http.Request) error {
 	return nil
 }
 
-func (handler *Handler) installChart(r *http.Request, p installChartPayload, dryRun bool) (*release.Release, error) {
+func (handler *Handler) installChart(r *http.Request, p installChartPayload) (*release.Release, error) {
 	clusterAccess, httperr := handler.getHelmClusterAccess(r)
 	if httperr != nil {
 		return nil, httperr.Err
@@ -109,11 +101,8 @@ func (handler *Handler) installChart(r *http.Request, p installChartPayload, dry
 	installOpts := options.InstallOptions{
 		Name:                    p.Name,
 		Chart:                   p.Chart,
-		Version:                 p.Version,
 		Namespace:               p.Namespace,
 		Repo:                    p.Repo,
-		Atomic:                  p.Atomic,
-		DryRun:                  dryRun,
 		KubernetesClusterAccess: clusterAccess,
 	}
 
@@ -141,14 +130,13 @@ func (handler *Handler) installChart(r *http.Request, p installChartPayload, dry
 		return nil, err
 	}
 
-	if !installOpts.DryRun {
-		manifest, err := handler.applyPortainerLabelsToHelmAppManifest(r, installOpts, release.Manifest)
-		if err != nil {
-			return nil, err
-		}
-		if err := handler.updateHelmAppManifest(r, manifest, installOpts.Namespace); err != nil {
-			return nil, err
-		}
+	manifest, err := handler.applyPortainerLabelsToHelmAppManifest(r, installOpts, release.Manifest)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := handler.updateHelmAppManifest(r, manifest, installOpts.Namespace); err != nil {
+		return nil, err
 	}
 
 	return release, nil
@@ -204,7 +192,7 @@ func (handler *Handler) updateHelmAppManifest(r *http.Request, manifest []byte,
 	g := new(errgroup.Group)
 	for _, resource := range yamlResources {
 		g.Go(func() error {
-			tmpfile, err := os.CreateTemp("", "helm-manifest-*.yaml")
+			tmpfile, err := os.CreateTemp("", "helm-manifest-*")
 			if err != nil {
 				return errors.Wrap(err, "failed to create a tmp helm manifest file")
 			}

api/http/handler/helm/helm_repo_search.go

@@ -7,7 +7,6 @@ import (
 
 	"github.com/portainer/portainer/pkg/libhelm/options"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
-	"github.com/portainer/portainer/pkg/libhttp/request"
 
 	"github.com/pkg/errors"
 )
@@ -18,8 +17,6 @@ import (
 // @description **Access policy**: authenticated
 // @tags helm
 // @param repo query string true "Helm repository URL"
-// @param chart query string false "Helm chart name"
-// @param useCache query string false "If true will use cache to search"
 // @security ApiKeyAuth
 // @security jwt
 // @produce json
@@ -35,19 +32,13 @@ func (handler *Handler) helmRepoSearch(w http.ResponseWriter, r *http.Request) *
 		return httperror.BadRequest("Bad request", errors.New("missing `repo` query parameter"))
 	}
 
-	chart, _ := request.RetrieveQueryParameter(r, "chart", false)
-	// If true will useCache to search, will always add to cache after
-	useCache, _ := request.RetrieveBooleanQueryParameter(r, "useCache", false)
-
 	_, err := url.ParseRequestURI(repo)
 	if err != nil {
 		return httperror.BadRequest("Bad request", errors.Wrap(err, fmt.Sprintf("provided URL %q is not valid", repo)))
 	}
 
 	searchOpts := options.SearchRepoOptions{
-		Repo:     repo,
-		Chart:    chart,
-		UseCache: useCache,
+		Repo: repo,
 	}
 
 	result, err := handler.helmPackageManager.SearchRepo(searchOpts)

api/http/handler/helm/helm_rollback.go

@@ -1,105 +0,0 @@
-package helm
-
-import (
-	"net/http"
-	"time"
-
-	"github.com/portainer/portainer/pkg/libhelm/options"
-	_ "github.com/portainer/portainer/pkg/libhelm/release"
-	httperror "github.com/portainer/portainer/pkg/libhttp/error"
-	"github.com/portainer/portainer/pkg/libhttp/request"
-	"github.com/portainer/portainer/pkg/libhttp/response"
-)
-
-// @id HelmRollback
-// @summary Rollback a helm release
-// @description Rollback a helm release to a previous revision
-// @description **Access policy**: authenticated
-// @tags helm
-// @security ApiKeyAuth || jwt
-// @produce json
-// @param id path int true "Environment(Endpoint) identifier"
-// @param release path string true "Helm release name"
-// @param namespace query string false "specify an optional namespace"
-// @param revision query int false "specify the revision to rollback to (defaults to previous revision if not specified)"
-// @param wait query boolean false "wait for resources to be ready (default: false)"
-// @param waitForJobs query boolean false "wait for jobs to complete before marking the release as successful (default: false)"
-// @param recreate query boolean false "performs pods restart for the resource if applicable (default: true)"
-// @param force query boolean false "force resource update through delete/recreate if needed (default: false)"
-// @param timeout query int false "time to wait for any individual Kubernetes operation in seconds (default: 300)"
-// @success 200 {object} release.Release "Success"
-// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
-// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
-// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
-// @failure 404 "Unable to find an environment with the specified identifier or release name."
-// @failure 500 "Server error occurred while attempting to rollback the release."
-// @router /endpoints/{id}/kubernetes/helm/{release}/rollback [post]
-func (handler *Handler) helmRollback(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
-	release, err := request.RetrieveRouteVariableValue(r, "release")
-	if err != nil {
-		return httperror.BadRequest("No release specified", err)
-	}
-
-	clusterAccess, httperr := handler.getHelmClusterAccess(r)
-	if httperr != nil {
-		return httperr
-	}
-
-	// build the rollback options
-	rollbackOpts := options.RollbackOptions{
-		KubernetesClusterAccess: clusterAccess,
-		Name:                    release,
-		// Set default values
-		Recreate: true,            // Default to recreate pods (restart)
-		Timeout:  5 * time.Minute, // Default timeout of 5 minutes
-	}
-
-	namespace, _ := request.RetrieveQueryParameter(r, "namespace", true)
-	// optional namespace. The library defaults to "default"
-	if namespace != "" {
-		rollbackOpts.Namespace = namespace
-	}
-
-	revision, _ := request.RetrieveNumericQueryParameter(r, "revision", true)
-	// optional revision. If not specified, it will rollback to the previous revision
-	if revision > 0 {
-		rollbackOpts.Version = revision
-	}
-
-	// Default for wait is false, only set to true if explicitly requested
-	wait, err := request.RetrieveBooleanQueryParameter(r, "wait", true)
-	if err == nil {
-		rollbackOpts.Wait = wait
-	}
-
-	// Default for waitForJobs is false, only set to true if explicitly requested
-	waitForJobs, err := request.RetrieveBooleanQueryParameter(r, "waitForJobs", true)
-	if err == nil {
-		rollbackOpts.WaitForJobs = waitForJobs
-	}
-
-	// Default for recreate is true (set above), override if specified
-	recreate, err := request.RetrieveBooleanQueryParameter(r, "recreate", true)
-	if err == nil {
-		rollbackOpts.Recreate = recreate
-	}
-
-	// Default for force is false, only set to true if explicitly requested
-	force, err := request.RetrieveBooleanQueryParameter(r, "force", true)
-	if err == nil {
-		rollbackOpts.Force = force
-	}
-
-	timeout, _ := request.RetrieveNumericQueryParameter(r, "timeout", true)
-	// Override default timeout if specified
-	if timeout > 0 {
-		rollbackOpts.Timeout = time.Duration(timeout) * time.Second
-	}
-
-	releaseInfo, err := handler.helmPackageManager.Rollback(rollbackOpts)
-	if err != nil {
-		return httperror.InternalServerError("Failed to rollback helm release", err)
-	}
-
-	return response.JSON(w, releaseInfo)
-}

api/http/handler/helm/helm_show.go

@@ -20,7 +20,6 @@ import (
 // @tags helm
 // @param repo query string true "Helm repository URL"
 // @param chart query string true "Chart name"
-// @param version query string true "Chart version"
 // @param command path string true "chart/values/readme"
 // @security ApiKeyAuth
 // @security jwt
@@ -46,11 +45,6 @@ func (handler *Handler) helmShow(w http.ResponseWriter, r *http.Request) *httper
 		return httperror.BadRequest("Bad request", errors.New("missing `chart` query parameter"))
 	}
 
-	version, err := request.RetrieveQueryParameter(r, "version", true)
-	if err != nil {
-		return httperror.BadRequest("Bad request", errors.Wrap(err, fmt.Sprintf("provided version %q is not valid", version)))
-	}
-
 	cmd, err := request.RetrieveRouteVariableValue(r, "command")
 	if err != nil {
 		cmd = "all"
@@ -61,7 +55,6 @@ func (handler *Handler) helmShow(w http.ResponseWriter, r *http.Request) *httper
 		OutputFormat: options.ShowOutputFormat(cmd),
 		Chart:        chart,
 		Repo:         repo,
-		Version:      version,
 	}
 	result, err := handler.helmPackageManager.Show(showOptions)
 	if err != nil {

api/http/handler/kubernetes/client.go

@@ -2,10 +2,8 @@ package kubernetes
 
 import (
 	"net/http"
-	"strconv"
 
 	"github.com/portainer/portainer/api/http/middlewares"
-	"github.com/portainer/portainer/api/http/security"
 	"github.com/portainer/portainer/api/kubernetes/cli"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/rs/zerolog/log"
@@ -27,19 +25,13 @@ func (handler *Handler) prepareKubeClient(r *http.Request) (*cli.KubeClient, *ht
 		return nil, httperror.NotFound("Unable to find the Kubernetes endpoint associated to the request.", err)
 	}
 
-	tokenData, err := security.RetrieveTokenData(r)
-	if err != nil {
-		log.Error().Err(err).Str("context", "prepareKubeClient").Msg("Unable to retrieve token data associated to the request.")
-		return nil, httperror.InternalServerError("Unable to retrieve token data associated to the request.", err)
-	}
-
-	pcli, err := handler.KubernetesClientFactory.GetPrivilegedUserKubeClient(endpoint, strconv.Itoa(int(tokenData.ID)))
+	pcli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
 	if err != nil {
 		log.Error().Err(err).Str("context", "prepareKubeClient").Msg("Unable to get a privileged Kubernetes client for the user.")
 		return nil, httperror.InternalServerError("Unable to get a privileged Kubernetes client for the user.", err)
 	}
-	pcli.SetIsKubeAdmin(cli.GetIsKubeAdmin())
-	pcli.SetClientNonAdminNamespaces(cli.GetClientNonAdminNamespaces())
+	pcli.IsKubeAdmin = cli.IsKubeAdmin
+	pcli.NonAdminNamespaces = cli.NonAdminNamespaces
 
 	return pcli, nil
 }

api/http/handler/kubernetes/cluster_role_bindings.go

@@ -32,7 +32,7 @@ func (handler *Handler) getAllKubernetesClusterRoleBindings(w http.ResponseWrite
 		return httperror.Forbidden("User is not authorized to fetch cluster role bindings from the Kubernetes cluster.", httpErr)
 	}
 
-	if !cli.GetIsKubeAdmin() {
+	if !cli.IsKubeAdmin {
 		log.Error().Str("context", "getAllKubernetesClusterRoleBindings").Msg("user is not authorized to fetch cluster role bindings from the Kubernetes cluster.")
 		return httperror.Forbidden("User is not authorized to fetch cluster role bindings from the Kubernetes cluster.", nil)
 	}

api/http/handler/kubernetes/cluster_roles.go

@@ -32,7 +32,7 @@ func (handler *Handler) getAllKubernetesClusterRoles(w http.ResponseWriter, r *h
 		return httperror.Forbidden("User is not authorized to fetch cluster roles from the Kubernetes cluster.", httpErr)
 	}
 
-	if !cli.GetIsKubeAdmin() {
+	if !cli.IsKubeAdmin {
 		log.Error().Str("context", "getAllKubernetesClusterRoles").Msg("user is not authorized to fetch cluster roles from the Kubernetes cluster.")
 		return httperror.Forbidden("User is not authorized to fetch cluster roles from the Kubernetes cluster.", nil)
 	}

api/http/handler/kubernetes/deprecated_routes.go

@@ -36,14 +36,11 @@ func deprecatedNamespaceParser(w http.ResponseWriter, r *http.Request) (string,
 
 	// Restore the original body for further use
 	bodyBytes, err := io.ReadAll(r.Body)
-	if err != nil {
-		return "", httperror.InternalServerError("Unable to read request body", err)
-	}
-
 	r.Body = io.NopCloser(bytes.NewBuffer(bodyBytes))
 
 	payload := models.K8sNamespaceDetails{}
-	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
 		return "", httperror.BadRequest("Invalid request. Unable to parse namespace payload", err)
 	}
 	namespaceName := payload.Name

api/http/handler/kubernetes/event.go

@@ -1,102 +0,0 @@
-package kubernetes
-
-import (
-	"net/http"
-
-	httperror "github.com/portainer/portainer/pkg/libhttp/error"
-	"github.com/portainer/portainer/pkg/libhttp/request"
-	"github.com/portainer/portainer/pkg/libhttp/response"
-	"github.com/rs/zerolog/log"
-	k8serrors "k8s.io/apimachinery/pkg/api/errors"
-)
-
-// @id getKubernetesEventsForNamespace
-// @summary Gets kubernetes events for namespace
-// @description Get events by optional query param resourceId for a given namespace.
-// @description **Access policy**: Authenticated user.
-// @tags kubernetes
-// @security ApiKeyAuth || jwt
-// @produce json
-// @param id path int true "Environment identifier"
-// @param namespace path string true "The namespace name the events are associated to"
-// @param resourceId query string false "The resource id of the involved kubernetes object" example:"e5b021b6-4bce-4c06-bd3b-6cca906797aa"
-// @success 200 {object} []kubernetes.K8sEvent "Success"
-// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
-// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
-// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
-// @failure 500 "Server error occurred while attempting to retrieve the events within the specified namespace."
-// @router /kubernetes/{id}/namespaces/{namespace}/events [get]
-func (handler *Handler) getKubernetesEventsForNamespace(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
-	namespace, err := request.RetrieveRouteVariableValue(r, "namespace")
-	if err != nil {
-		log.Error().Err(err).Str("context", "getKubernetesEvents").Str("namespace", namespace).Msg("Unable to retrieve namespace identifier route variable")
-		return httperror.BadRequest("Unable to retrieve namespace identifier route variable", err)
-	}
-
-	resourceId, err := request.RetrieveQueryParameter(r, "resourceId", true)
-	if err != nil {
-		log.Error().Err(err).Str("context", "getKubernetesEvents").Msg("Unable to retrieve resourceId query parameter")
-		return httperror.BadRequest("Unable to retrieve resourceId query parameter", err)
-	}
-
-	cli, httpErr := handler.getProxyKubeClient(r)
-	if httpErr != nil {
-		log.Error().Err(httpErr).Str("context", "getKubernetesEvents").Str("resourceId", resourceId).Msg("Unable to get a Kubernetes client for the user")
-		return httperror.InternalServerError("Unable to get a Kubernetes client for the user", httpErr)
-	}
-
-	events, err := cli.GetEvents(namespace, resourceId)
-	if err != nil {
-		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
-			log.Error().Err(err).Str("context", "getKubernetesEvents").Msg("Unauthorized access to the Kubernetes API")
-			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
-		}
-
-		log.Error().Err(err).Str("context", "getKubernetesEvents").Msg("Unable to retrieve events")
-		return httperror.InternalServerError("Unable to retrieve events", err)
-	}
-
-	return response.JSON(w, events)
-}
-
-// @id getAllKubernetesEvents
-// @summary Gets kubernetes events
-// @description Get events by query param resourceId
-// @description **Access policy**: Authenticated user.
-// @tags kubernetes
-// @security ApiKeyAuth || jwt
-// @produce json
-// @param id path int true "Environment identifier"
-// @param resourceId query string false "The resource id of the involved kubernetes object"  example:"e5b021b6-4bce-4c06-bd3b-6cca906797aa"
-// @success 200 {object} []kubernetes.K8sEvent "Success"
-// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
-// @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
-// @failure 403 "Permission denied - the user is authenticated but does not have the necessary permissions to access the requested resource or perform the specified operation. Check your user roles and permissions."
-// @failure 500 "Server error occurred while attempting to retrieve the events."
-// @router /kubernetes/{id}/events [get]
-func (handler *Handler) getAllKubernetesEvents(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
-	resourceId, err := request.RetrieveQueryParameter(r, "resourceId", true)
-	if err != nil {
-		log.Error().Err(err).Str("context", "getKubernetesEvents").Msg("Unable to retrieve resourceId query parameter")
-		return httperror.BadRequest("Unable to retrieve resourceId query parameter", err)
-	}
-
-	cli, httpErr := handler.getProxyKubeClient(r)
-	if httpErr != nil {
-		log.Error().Err(httpErr).Str("context", "getKubernetesEvents").Str("resourceId", resourceId).Msg("Unable to get a Kubernetes client for the user")
-		return httperror.InternalServerError("Unable to get a Kubernetes client for the user", httpErr)
-	}
-
-	events, err := cli.GetEvents("", resourceId)
-	if err != nil {
-		if k8serrors.IsUnauthorized(err) || k8serrors.IsForbidden(err) {
-			log.Error().Err(err).Str("context", "getKubernetesEvents").Msg("Unauthorized access to the Kubernetes API")
-			return httperror.Forbidden("Unauthorized access to the Kubernetes API", err)
-		}
-
-		log.Error().Err(err).Str("context", "getKubernetesEvents").Msg("Unable to retrieve events")
-		return httperror.InternalServerError("Unable to retrieve events", err)
-	}
-
-	return response.JSON(w, events)
-}

api/http/handler/kubernetes/event_test.go

@@ -1,60 +0,0 @@
-package kubernetes
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/api/http/security"
-	"github.com/portainer/portainer/api/internal/authorization"
-	"github.com/portainer/portainer/api/internal/testhelpers"
-	"github.com/portainer/portainer/api/jwt"
-	"github.com/portainer/portainer/api/kubernetes"
-	kubeClient "github.com/portainer/portainer/api/kubernetes/cli"
-	"github.com/stretchr/testify/assert"
-)
-
-// Currently this test just tests the HTTP Handler is setup correctly, in the future we should move the ClientFactory to a mock in order
-// test the logic in event.go
-func TestGetKubernetesEvents(t *testing.T) {
-	is := assert.New(t)
-
-	_, store := datastore.MustNewTestStore(t, true, true)
-
-	err := store.Endpoint().Create(&portainer.Endpoint{
-		ID:   1,
-		Type: portainer.AgentOnKubernetesEnvironment,
-	},
-	)
-	is.NoError(err, "error creating environment")
-
-	err = store.User().Create(&portainer.User{Username: "admin", Role: portainer.AdministratorRole})
-	is.NoError(err, "error creating a user")
-
-	jwtService, err := jwt.NewService("1h", store)
-	is.NoError(err, "Error initiating jwt service")
-
-	tk, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: 1, Username: "admin", Role: portainer.AdministratorRole})
-
-	kubeClusterAccessService := kubernetes.NewKubeClusterAccessService("", "", "")
-
-	cli := testhelpers.NewKubernetesClient()
-	factory, _ := kubeClient.NewClientFactory(nil, nil, store, "", "", "")
-
-	authorizationService := authorization.NewService(store)
-	handler := NewHandler(testhelpers.NewTestRequestBouncer(), authorizationService, store, jwtService, kubeClusterAccessService,
-		factory, cli)
-	is.NotNil(handler, "Handler should not fail")
-
-	req := httptest.NewRequest(http.MethodGet, "/kubernetes/1/events?resourceId=8", nil)
-	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: 1, Username: "admin", Role: 1})
-	req = req.WithContext(ctx)
-	testhelpers.AddTestSecurityCookie(req, tk)
-
-	rr := httptest.NewRecorder()
-	handler.ServeHTTP(rr, req)
-
-	is.Equal(http.StatusOK, rr.Code, "Status should be 200")
-}

api/http/handler/kubernetes/handler.go

@@ -58,7 +58,6 @@ func NewHandler(bouncer security.BouncerService, authorizationService *authoriza
 	endpointRouter.Handle("/configmaps/count", httperror.LoggerHandler(h.getAllKubernetesConfigMapsCount)).Methods(http.MethodGet)
 	endpointRouter.Handle("/cron_jobs", httperror.LoggerHandler(h.getAllKubernetesCronJobs)).Methods(http.MethodGet)
 	endpointRouter.Handle("/cron_jobs/delete", httperror.LoggerHandler(h.deleteKubernetesCronJobs)).Methods(http.MethodPost)
-	endpointRouter.Handle("/events", httperror.LoggerHandler(h.getAllKubernetesEvents)).Methods(http.MethodGet)
 	endpointRouter.Handle("/jobs", httperror.LoggerHandler(h.getAllKubernetesJobs)).Methods(http.MethodGet)
 	endpointRouter.Handle("/jobs/delete", httperror.LoggerHandler(h.deleteKubernetesJobs)).Methods(http.MethodPost)
 	endpointRouter.Handle("/cluster_roles", httperror.LoggerHandler(h.getAllKubernetesClusterRoles)).Methods(http.MethodGet)
@@ -111,7 +110,6 @@ func NewHandler(bouncer security.BouncerService, authorizationService *authoriza
 	// to keep it simple, we've decided to leave it like this.
 	namespaceRouter := endpointRouter.PathPrefix("/namespaces/{namespace}").Subrouter()
 	namespaceRouter.Handle("/configmaps/{configmap}", httperror.LoggerHandler(h.getKubernetesConfigMap)).Methods(http.MethodGet)
-	namespaceRouter.Handle("/events", httperror.LoggerHandler(h.getKubernetesEventsForNamespace)).Methods(http.MethodGet)
 	namespaceRouter.Handle("/system", bouncer.RestrictedAccess(httperror.LoggerHandler(h.namespacesToggleSystem))).Methods(http.MethodPut)
 	namespaceRouter.Handle("/ingresscontrollers", httperror.LoggerHandler(h.getKubernetesIngressControllersByNamespace)).Methods(http.MethodGet)
 	namespaceRouter.Handle("/ingresscontrollers", httperror.LoggerHandler(h.updateKubernetesIngressControllersByNamespace)).Methods(http.MethodPut)
@@ -135,7 +133,7 @@ func NewHandler(bouncer security.BouncerService, authorizationService *authoriza
 // getProxyKubeClient gets a kubeclient for the user.  It's generally what you want as it retrieves the kubeclient
 // from the Authorization token of the currently logged in user.  The kubeclient that is not from the proxy is actually using
 // admin permissions.  If you're unsure which one to use, use this.
-func (h *Handler) getProxyKubeClient(r *http.Request) (portainer.KubeClient, *httperror.HandlerError) {
+func (h *Handler) getProxyKubeClient(r *http.Request) (*cli.KubeClient, *httperror.HandlerError) {
 	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
 	if err != nil {
 		return nil, httperror.BadRequest(fmt.Sprintf("an error occurred during the getProxyKubeClient operation, the environment identifier route variable is invalid for /api/kubernetes/%d. Error: ", endpointID), err)
@@ -146,7 +144,7 @@ func (h *Handler) getProxyKubeClient(r *http.Request) (portainer.KubeClient, *ht
 		return nil, httperror.Forbidden(fmt.Sprintf("an error occurred during the getProxyKubeClient operation, permission denied to access the environment /api/kubernetes/%d. Error: ", endpointID), err)
 	}
 
-	cli, ok := h.KubernetesClientFactory.GetProxyKubeClient(strconv.Itoa(endpointID), strconv.Itoa(int(tokenData.ID)))
+	cli, ok := h.KubernetesClientFactory.GetProxyKubeClient(strconv.Itoa(endpointID), tokenData.Token)
 	if !ok {
 		return nil, httperror.InternalServerError("an error occurred during the getProxyKubeClient operation,failed to get proxy KubeClient", nil)
 	}
@@ -179,7 +177,7 @@ func (handler *Handler) kubeClientMiddleware(next http.Handler) http.Handler {
 		}
 
 		// Check if we have a kubeclient against this auth token already, otherwise generate a new one
-		_, ok := handler.KubernetesClientFactory.GetProxyKubeClient(strconv.Itoa(endpointID), strconv.Itoa(int(tokenData.ID)))
+		_, ok := handler.KubernetesClientFactory.GetProxyKubeClient(strconv.Itoa(endpointID), tokenData.Token)
 		if ok {
 			next.ServeHTTP(w, r)
 			return
@@ -255,7 +253,7 @@ func (handler *Handler) kubeClientMiddleware(next http.Handler) http.Handler {
 			return
 		}
 		serverURL.Scheme = "https"
-		serverURL.Host = "localhost" + handler.KubernetesClientFactory.GetAddrHTTPS()
+		serverURL.Host = "localhost" + handler.KubernetesClientFactory.AddrHTTPS
 		config.Clusters[0].Cluster.Server = serverURL.String()
 
 		yaml, err := cli.GenerateYAML(config)
@@ -269,7 +267,7 @@ func (handler *Handler) kubeClientMiddleware(next http.Handler) http.Handler {
 			return
 		}
 
-		handler.KubernetesClientFactory.SetProxyKubeClient(strconv.Itoa(int(endpoint.ID)), strconv.Itoa(int(tokenData.ID)), kubeCli)
+		handler.KubernetesClientFactory.SetProxyKubeClient(strconv.Itoa(int(endpoint.ID)), tokenData.Token, kubeCli)
 		next.ServeHTTP(w, r)
 	})
 }

api/http/handler/kubernetes/namespaces.go

@@ -22,7 +22,6 @@ import (
 // @produce json
 // @param id path int true "Environment identifier"
 // @param withResourceQuota query boolean true "When set to true, include the resource quota information as part of the Namespace information. Default is false"
-// @param withUnhealthyEvents query boolean true "When set to true, include the unhealthy events information as part of the Namespace information. Default is false"
 // @success 200 {array} portainer.K8sNamespaceInfo "Success"
 // @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
 // @failure 401 "Unauthorized access - the user is not authenticated or does not have the necessary permissions. Ensure that you have provided a valid API key or JWT token, and that you have the required permissions."
@@ -37,12 +36,6 @@ func (handler *Handler) getKubernetesNamespaces(w http.ResponseWriter, r *http.R
 		return httperror.BadRequest("an error occurred during the GetKubernetesNamespaces operation, invalid query parameter withResourceQuota. Error: ", err)
 	}
 
-	withUnhealthyEvents, err := request.RetrieveBooleanQueryParameter(r, "withUnhealthyEvents", true)
-	if err != nil {
-		log.Error().Err(err).Str("context", "GetKubernetesNamespaces").Msg("Invalid query parameter withUnhealthyEvents")
-		return httperror.BadRequest("an error occurred during the GetKubernetesNamespaces operation, invalid query parameter withUnhealthyEvents. Error: ", err)
-	}
-
 	cli, httpErr := handler.prepareKubeClient(r)
 	if httpErr != nil {
 		log.Error().Err(httpErr).Str("context", "GetKubernetesNamespaces").Msg("Unable to get a Kubernetes client for the user")
@@ -55,14 +48,6 @@ func (handler *Handler) getKubernetesNamespaces(w http.ResponseWriter, r *http.R
 		return httperror.InternalServerError("an error occurred during the GetKubernetesNamespaces operation, unable to retrieve namespaces from the Kubernetes cluster. Error: ", err)
 	}
 
-	if withUnhealthyEvents {
-		namespaces, err = cli.CombineNamespacesWithUnhealthyEvents(namespaces)
-		if err != nil {
-			log.Error().Err(err).Str("context", "GetKubernetesNamespaces").Msg("Unable to combine namespaces with unhealthy events")
-			return httperror.InternalServerError("an error occurred during the GetKubernetesNamespaces operation, unable to combine namespaces with unhealthy events. Error: ", err)
-		}
-	}
-
 	if withResourceQuota {
 		return cli.CombineNamespacesWithResourceQuotas(namespaces, w)
 	}

api/http/handler/motd/motd.go

@@ -7,9 +7,7 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/http/client"
 	"github.com/portainer/portainer/pkg/libcrypto"
-	libclient "github.com/portainer/portainer/pkg/libhttp/client"
 	"github.com/portainer/portainer/pkg/libhttp/response"
-	"github.com/rs/zerolog/log"
 
 	"github.com/segmentio/encoding/json"
 )
@@ -39,12 +37,6 @@ type motdData struct {
 // @success 200 {object} motdResponse
 // @router /motd [get]
 func (handler *Handler) motd(w http.ResponseWriter, r *http.Request) {
-	if err := libclient.ExternalRequestDisabled(portainer.MessageOfTheDayURL); err != nil {
-		log.Debug().Err(err).Msg("External request disabled: MOTD")
-		response.JSON(w, &motdResponse{Message: ""})
-		return
-	}
-
 	motd, err := client.Get(portainer.MessageOfTheDayURL, 0)
 	if err != nil {
 		response.JSON(w, &motdResponse{Message: ""})

api/http/handler/registries/handler.go

@@ -5,10 +5,10 @@ import (
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
-	httperrors "github.com/portainer/portainer/api/http/errors"
 	"github.com/portainer/portainer/api/http/proxy"
 	"github.com/portainer/portainer/api/http/security"
-	"github.com/portainer/portainer/api/internal/registryutils/access"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/kubernetes"
 	"github.com/portainer/portainer/api/kubernetes/cli"
 	"github.com/portainer/portainer/api/pendingactions"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
@@ -17,7 +17,6 @@ import (
 	"github.com/gorilla/mux"
 
 	"github.com/pkg/errors"
-	"github.com/rs/zerolog/log"
 )
 
 func hideFields(registry *portainer.Registry, hideAccesses bool) {
@@ -57,20 +56,17 @@ func newHandler(bouncer security.BouncerService) *Handler {
 func (handler *Handler) initRouter(bouncer accessGuard) {
 	adminRouter := handler.NewRoute().Subrouter()
 	adminRouter.Use(bouncer.AdminAccess)
+
+	authenticatedRouter := handler.NewRoute().Subrouter()
+	authenticatedRouter.Use(bouncer.AuthenticatedAccess)
+
 	adminRouter.Handle("/registries", httperror.LoggerHandler(handler.registryList)).Methods(http.MethodGet)
 	adminRouter.Handle("/registries", httperror.LoggerHandler(handler.registryCreate)).Methods(http.MethodPost)
 	adminRouter.Handle("/registries/{id}", httperror.LoggerHandler(handler.registryUpdate)).Methods(http.MethodPut)
 	adminRouter.Handle("/registries/{id}/configure", httperror.LoggerHandler(handler.registryConfigure)).Methods(http.MethodPost)
 	adminRouter.Handle("/registries/{id}", httperror.LoggerHandler(handler.registryDelete)).Methods(http.MethodDelete)
 
-	// Use registry-specific access bouncer for inspect and repositories endpoints
-	registryAccessRouter := handler.NewRoute().Subrouter()
-	registryAccessRouter.Use(bouncer.AuthenticatedAccess, handler.RegistryAccess)
-	registryAccessRouter.Handle("/registries/{id}", httperror.LoggerHandler(handler.registryInspect)).Methods(http.MethodGet)
-
-	// Keep the gitlab proxy on the regular authenticated router as it doesn't require specific registry access
-	authenticatedRouter := handler.NewRoute().Subrouter()
-	authenticatedRouter.Use(bouncer.AuthenticatedAccess)
+	authenticatedRouter.Handle("/registries/{id}", httperror.LoggerHandler(handler.registryInspect)).Methods(http.MethodGet)
 	authenticatedRouter.PathPrefix("/registries/proxies/gitlab").Handler(httperror.LoggerHandler(handler.proxyRequestsToGitlabAPIWithoutRegistry))
 }
 
@@ -92,7 +88,9 @@ func (handler *Handler) registriesHaveSameURLAndCredentials(r1, r2 *portainer.Re
 }
 
 // this function validates that
+//
 // 1. user has the appropriate authorizations to perform the request
+//
 // 2. user has a direct or indirect access to the registry
 func (handler *Handler) userHasRegistryAccess(r *http.Request, registry *portainer.Registry) (hasAccess bool, isAdmin bool, err error) {
 	securityContext, err := security.RetrieveRestrictedRequestContext(r)
@@ -100,6 +98,11 @@ func (handler *Handler) userHasRegistryAccess(r *http.Request, registry *portain
 		return false, false, err
 	}
 
+	user, err := handler.DataStore.User().Read(securityContext.UserID)
+	if err != nil {
+		return false, false, err
+	}
+
 	// Portainer admins always have access to everything
 	if securityContext.IsAdmin {
 		return true, true, nil
@@ -125,68 +128,47 @@ func (handler *Handler) userHasRegistryAccess(r *http.Request, registry *portain
 		return false, false, err
 	}
 
-	// Use the enhanced registry access utility function that includes namespace validation
-	_, err = access.GetAccessibleRegistry(
-		handler.DataStore,
-		handler.K8sClientFactory,
-		securityContext.UserID,
-		endpointId,
-		registry.ID,
-	)
+	memberships, err := handler.DataStore.TeamMembership().TeamMembershipsByUserID(user.ID)
 	if err != nil {
-		return false, false, nil // No access
+		return false, false, nil
 	}
 
-	return true, false, nil
-}
-
-// RegistryAccess defines a security check for registry-specific API endpoints.
-// Authentication is required to access these endpoints.
-// The user must have direct or indirect access to the specific registry being requested.
-// This bouncer validates registry access using the userHasRegistryAccess logic.
-func (handler *Handler) RegistryAccess(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// First ensure the user is authenticated
-		tokenData, err := security.RetrieveTokenData(r)
-		if err != nil {
-			httperror.WriteError(w, http.StatusUnauthorized, "Authentication required", httperrors.ErrUnauthorized)
-			return
-		}
-
-		// Extract registry ID from the route
-		registryID, err := request.RetrieveNumericRouteVariableValue(r, "id")
-		if err != nil {
-			httperror.WriteError(w, http.StatusBadRequest, "Invalid registry identifier route variable", err)
-			return
-		}
-
-		// Get the registry from the database
-		registry, err := handler.DataStore.Registry().Read(portainer.RegistryID(registryID))
-		if handler.DataStore.IsErrObjectNotFound(err) {
-			httperror.WriteError(w, http.StatusNotFound, "Unable to find a registry with the specified identifier inside the database", err)
-			return
-		} else if err != nil {
-			httperror.WriteError(w, http.StatusInternalServerError, "Unable to find a registry with the specified identifier inside the database", err)
-			return
-		}
-
-		// Check if user has access to this registry
-		hasAccess, _, err := handler.userHasRegistryAccess(r, registry)
-		if err != nil {
-			httperror.WriteError(w, http.StatusInternalServerError, "Unable to retrieve info from request context", err)
-			return
-		}
-		if !hasAccess {
-			log.Debug().
-				Int("registry_id", registryID).
-				Str("registry_name", registry.Name).
-				Int("user_id", int(tokenData.ID)).
-				Str("context", "RegistryAccessBouncer").
-				Msg("User access denied to registry")
-			httperror.WriteError(w, http.StatusForbidden, "Access denied to resource", httperrors.ErrResourceAccessDenied)
-			return
-		}
-
-		next.ServeHTTP(w, r)
-	})
+	// validate access for kubernetes namespaces (leverage registry.RegistryAccesses[endpointId].Namespaces)
+	if endpointutils.IsKubernetesEndpoint(endpoint) {
+		kcl, err := handler.K8sClientFactory.GetPrivilegedKubeClient(endpoint)
+		if err != nil {
+			return false, false, errors.Wrap(err, "unable to retrieve kubernetes client to validate registry access")
+		}
+		accessPolicies, err := kcl.GetNamespaceAccessPolicies()
+		if err != nil {
+			return false, false, errors.Wrap(err, "unable to retrieve environment's namespaces policies to validate registry access")
+		}
+
+		authorizedNamespaces := registry.RegistryAccesses[endpointId].Namespaces
+
+		for _, namespace := range authorizedNamespaces {
+			// when the default namespace is authorized to use a registry, all users have the ability to use it
+			// unless the default namespace is restricted: in this case continue to search for other potential accesses authorizations
+			if namespace == kubernetes.DefaultNamespace && !endpoint.Kubernetes.Configuration.RestrictDefaultNamespace {
+				return true, false, nil
+			}
+
+			namespacePolicy := accessPolicies[namespace]
+			if security.AuthorizedAccess(user.ID, memberships, namespacePolicy.UserAccessPolicies, namespacePolicy.TeamAccessPolicies) {
+				return true, false, nil
+			}
+		}
+		return false, false, nil
+	}
+
+	// validate access for docker environments
+	// leverage registry.RegistryAccesses[endpointId].UserAccessPolicies (direct access)
+	// and registry.RegistryAccesses[endpointId].TeamAccessPolicies (indirect access via his teams)
+	if security.AuthorizedRegistryAccess(registry, user, memberships, endpoint.ID) {
+		return true, false, nil
+	}
+
+	// when user has no access via their role, direct grant or indirect grant
+	// then they don't have access to the registry
+	return false, false, nil
 }

api/http/handler/registries/registry_access_test.go

@@ -1,89 +0,0 @@
-package registries
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/api/http/security"
-	"github.com/portainer/portainer/api/internal/testhelpers"
-
-	"github.com/gorilla/mux"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_RegistryAccess_RequiresAuthentication(t *testing.T) {
-	_, store := datastore.MustNewTestStore(t, true, true)
-	registry := &portainer.Registry{
-		ID:   1,
-		Name: "test-registry",
-		URL:  "https://registry.test.com",
-	}
-	err := store.Registry().Create(registry)
-	assert.NoError(t, err)
-	handler := &Handler{
-		DataStore: store,
-	}
-	req := httptest.NewRequest(http.MethodGet, "/registries/1", nil)
-	req = mux.SetURLVars(req, map[string]string{"id": "1"})
-	rr := httptest.NewRecorder()
-	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	})
-	bouncer := handler.RegistryAccess(testHandler)
-	bouncer.ServeHTTP(rr, req)
-	assert.Equal(t, http.StatusUnauthorized, rr.Code)
-}
-
-func Test_RegistryAccess_InvalidRegistryID(t *testing.T) {
-	_, store := datastore.MustNewTestStore(t, true, true)
-	user := &portainer.User{ID: 1, Username: "test", Role: portainer.StandardUserRole}
-	err := store.User().Create(user)
-	assert.NoError(t, err)
-
-	handler := &Handler{
-		DataStore: store,
-	}
-	req := httptest.NewRequest(http.MethodGet, "/registries/invalid", nil)
-	req = mux.SetURLVars(req, map[string]string{"id": "invalid"})
-	tokenData := &portainer.TokenData{ID: 1, Role: portainer.StandardUserRole}
-	req = req.WithContext(security.StoreTokenData(req, tokenData))
-
-	rr := httptest.NewRecorder()
-
-	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	})
-
-	bouncer := handler.RegistryAccess(testHandler)
-	bouncer.ServeHTTP(rr, req)
-	assert.Equal(t, http.StatusBadRequest, rr.Code)
-}
-
-func Test_RegistryAccess_RegistryNotFound(t *testing.T) {
-	_, store := datastore.MustNewTestStore(t, true, true)
-	user := &portainer.User{ID: 1, Username: "test", Role: portainer.StandardUserRole}
-	err := store.User().Create(user)
-	assert.NoError(t, err)
-
-	handler := &Handler{
-		DataStore:      store,
-		requestBouncer: testhelpers.NewTestRequestBouncer(),
-	}
-	req := httptest.NewRequest(http.MethodGet, "/registries/999", nil)
-	req = mux.SetURLVars(req, map[string]string{"id": "999"})
-	tokenData := &portainer.TokenData{ID: 1, Role: portainer.StandardUserRole}
-	req = req.WithContext(security.StoreTokenData(req, tokenData))
-
-	rr := httptest.NewRecorder()
-
-	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	})
-
-	bouncer := handler.RegistryAccess(testHandler)
-	bouncer.ServeHTTP(rr, req)
-	assert.Equal(t, http.StatusNotFound, rr.Code)
-}

api/http/handler/registries/registry_inspect.go

@@ -4,12 +4,10 @@ import (
 	"net/http"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/http/security"
+	httperrors "github.com/portainer/portainer/api/http/errors"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
-
-	"github.com/rs/zerolog/log"
 )
 
 // @id RegistryInspect
@@ -33,11 +31,6 @@ func (handler *Handler) registryInspect(w http.ResponseWriter, r *http.Request)
 		return httperror.BadRequest("Invalid registry identifier route variable", err)
 	}
 
-	log.Debug().
-		Int("registry_id", registryID).
-		Str("context", "RegistryInspectHandler").
-		Msg("Starting registry inspection")
-
 	registry, err := handler.DataStore.Registry().Read(portainer.RegistryID(registryID))
 	if handler.DataStore.IsErrObjectNotFound(err) {
 		return httperror.NotFound("Unable to find a registry with the specified identifier inside the database", err)
@@ -45,12 +38,14 @@ func (handler *Handler) registryInspect(w http.ResponseWriter, r *http.Request)
 		return httperror.InternalServerError("Unable to find a registry with the specified identifier inside the database", err)
 	}
 
-	// Check if user is admin to determine if we should hide sensitive fields
-	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	hasAccess, isAdmin, err := handler.userHasRegistryAccess(r, registry)
 	if err != nil {
 		return httperror.InternalServerError("Unable to retrieve info from request context", err)
 	}
+	if !hasAccess {
+		return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+	}
 
-	hideFields(registry, !securityContext.IsAdmin)
+	hideFields(registry, !isAdmin)
 	return response.JSON(w, registry)
 }

api/http/handler/settings/settings_update.go

@@ -14,8 +14,8 @@ import (
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
-	"github.com/portainer/portainer/pkg/validate"
 
+	"github.com/asaskevich/govalidator"
 	"github.com/pkg/errors"
 	"golang.org/x/oauth2"
 )
@@ -62,15 +62,15 @@ func (payload *settingsUpdatePayload) Validate(r *http.Request) error {
 		return errors.New("Invalid authentication method value. Value must be one of: 1 (internal), 2 (LDAP/AD) or 3 (OAuth)")
 	}
 
-	if payload.LogoURL != nil && *payload.LogoURL != "" && !validate.IsURL(*payload.LogoURL) {
+	if payload.LogoURL != nil && *payload.LogoURL != "" && !govalidator.IsURL(*payload.LogoURL) {
 		return errors.New("Invalid logo URL. Must correspond to a valid URL format")
 	}
 
-	if payload.TemplatesURL != nil && *payload.TemplatesURL != "" && !validate.IsURL(*payload.TemplatesURL) {
+	if payload.TemplatesURL != nil && *payload.TemplatesURL != "" && !govalidator.IsURL(*payload.TemplatesURL) {
 		return errors.New("Invalid external templates URL. Must correspond to a valid URL format")
 	}
 
-	if payload.HelmRepositoryURL != nil && *payload.HelmRepositoryURL != "" && !validate.IsURL(*payload.HelmRepositoryURL) {
+	if payload.HelmRepositoryURL != nil && *payload.HelmRepositoryURL != "" && !govalidator.IsURL(*payload.HelmRepositoryURL) {
 		return errors.New("Invalid Helm repository URL. Must correspond to a valid URL format")
 	}
 

api/http/handler/stacks/create_compose_stack.go

@@ -14,8 +14,8 @@ import (
 	"github.com/portainer/portainer/api/stacks/stackutils"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
-	"github.com/portainer/portainer/pkg/validate"
 
+	"github.com/asaskevich/govalidator"
 	"github.com/pkg/errors"
 	"github.com/rs/zerolog/log"
 )
@@ -205,7 +205,7 @@ func (payload *composeStackFromGitRepositoryPayload) Validate(r *http.Request) e
 	if len(payload.Name) == 0 {
 		return errors.New("Invalid stack name")
 	}
-	if len(payload.RepositoryURL) == 0 || !validate.IsURL(payload.RepositoryURL) {
+	if len(payload.RepositoryURL) == 0 || !govalidator.IsURL(payload.RepositoryURL) {
 		return errors.New("Invalid repository URL. Must correspond to a valid URL format")
 	}
 	if payload.RepositoryAuthentication && len(payload.RepositoryPassword) == 0 {

api/http/handler/stacks/create_kubernetes_stack.go

@@ -15,8 +15,8 @@ import (
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
-	"github.com/portainer/portainer/pkg/validate"
 
+	"github.com/asaskevich/govalidator"
 	"github.com/pkg/errors"
 )
 
@@ -96,7 +96,7 @@ func (payload *kubernetesStringDeploymentPayload) Validate(r *http.Request) erro
 }
 
 func (payload *kubernetesGitDeploymentPayload) Validate(r *http.Request) error {
-	if len(payload.RepositoryURL) == 0 || !validate.IsURL(payload.RepositoryURL) {
+	if len(payload.RepositoryURL) == 0 || !govalidator.IsURL(payload.RepositoryURL) {
 		return errors.New("Invalid repository URL. Must correspond to a valid URL format")
 	}
 
@@ -112,7 +112,7 @@ func (payload *kubernetesGitDeploymentPayload) Validate(r *http.Request) error {
 }
 
 func (payload *kubernetesManifestURLDeploymentPayload) Validate(r *http.Request) error {
-	if len(payload.ManifestURL) == 0 || !validate.IsURL(payload.ManifestURL) {
+	if len(payload.ManifestURL) == 0 || !govalidator.IsURL(payload.ManifestURL) {
 		return errors.New("Invalid manifest URL")
 	}
 

api/http/handler/stacks/create_swarm_stack.go

@@ -11,8 +11,8 @@ import (
 	"github.com/portainer/portainer/api/stacks/stackutils"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
-	valid "github.com/portainer/portainer/pkg/validate"
 
+	"github.com/asaskevich/govalidator"
 	"github.com/pkg/errors"
 )
 
@@ -142,7 +142,7 @@ func (payload *swarmStackFromGitRepositoryPayload) Validate(r *http.Request) err
 	if len(payload.SwarmID) == 0 {
 		return errors.New("Invalid Swarm ID")
 	}
-	if len(payload.RepositoryURL) == 0 || !valid.IsURL(payload.RepositoryURL) {
+	if len(payload.RepositoryURL) == 0 || !govalidator.IsURL(payload.RepositoryURL) {
 		return errors.New("Invalid repository URL. Must correspond to a valid URL format")
 	}
 	if payload.RepositoryAuthentication && len(payload.RepositoryPassword) == 0 {