Fix: loading in namespaces under reduced RBAC #2130

Nokel81 · 2021-02-11T16:11:06Z

don't assume that loading "all namespaces" that lens knows about is the same as loading "all namespaces" that exist on the cluster
Track when actually listing namespaces

Signed-off-by: Sebastian Malton sebastian@malton.name

- don't assume that loading "all namespaces" that lens knows about is the same as loading "all namespaces" that exist on the cluster - Track when actually listing namespaces Signed-off-by: Sebastian Malton <sebastian@malton.name>

Nokel81 · 2021-02-11T16:12:22Z

src/renderer/api/kube-watch-api.ts

@@ -64,36 +64,51 @@ export class KubeWatchApi {
    let isUnsubscribed = false;

    const load = (namespaces = subscribingNamespaces) => this.preloadStores(stores, { namespaces, loadOnce });
-    let preloading = preload && load();
+    let preloading: boolean | ReturnType<typeof load> = preload && load();


This is the correct typing of this value. I assume that because we aren't using strict: true it was typed as only ReturnType<typeof load>

Nokel81 · 2021-02-11T16:12:42Z

src/renderer/api/kube-watch-api.ts

+      for (const store of stores) {
+        if (!signal.aborted) {
+          unsubscribeList.push(await store.subscribe());
+        }
+      }


fail quickly if we shouldn't load the stores

Nokel81 · 2021-02-11T16:13:26Z

src/renderer/api/kube-watch-api.ts

+          unsubscribeList.forEach(unsubscribe => unsubscribe());
+          unsubscribeList.length = 0;


This list is only "full" after subscribeP has "finished"

Nokel81 · 2021-02-11T16:15:39Z

src/renderer/components/+namespaces/namespace.store.ts

+  async getSubscribeApis() {
+    await this.contextReady;
+
    // if user has given static list of namespaces let's not start watches because watch adds stuff that's not wanted
-    if (this.context?.cluster.accessibleNamespaces.length > 0) {
+    if (this.context.cluster.accessibleNamespaces.length > 0) {


For this to be actually correct we need to always wait for the context to be ready. Otherwise we would return an API if this function was called before the context was ready.

Nokel81 · 2021-02-11T16:16:13Z

src/renderer/components/context.ts

@@ -5,7 +5,7 @@ import { namespaceStore } from "./+namespaces/namespace.store";
 export interface ClusterContext {
  cluster?: Cluster;
  allNamespaces?: string[]; // available / allowed namespaces from cluster.ts
-  contextNamespaces?: string[]; // selected by user (see: namespace-select.tsx)
+  selectedNamespaces?: string[]; // selected by user (see: namespace-select.tsx)


I can revert this change if wanted. But contextNamespaces is a very not descriptive name IMO.

ixrock · 2021-02-11T16:32:47Z

src/renderer/components/+namespaces/namespace.store.ts

@@ -108,9 +112,11 @@ export class NamespaceStore extends KubeObjectStore<Namespace> {
    return namespaces;
  }

-  getSubscribeApis() {
+  async getSubscribeApis() {


Why it's became async?

Because we need to wait for contextReady

ixrock · 2021-02-11T16:38:27Z

src/main/cluster.ts

+   *
+   * @observable
+   */
+  @observable listedNamespaces = false;


Why do we need this when we have already cluster.accessibleNamespaces and cluster.allowedNamespaces?
If accessibleNamespaces is provided by user it must be used first.

Otherwise maybe better to use this as I understand it correct it serves same purpose?

@computed get listedNamespaces(): boolean { return !this.accessibleNamespaces.length; }

Because allowedNamespaces might also be from the context. See line 700

I tought allowedNamespaces must be only from the context? No?

Or by listing via the kube api ( which I believe is the most common)

Also there are some inconsistency between 2 methods imho:

protected async getAllowedNamespaces() { // get allowed? if (this.accessibleNamespaces.length) { return this.accessibleNamespaces; // No, get accessible! } protected async getAllowedResources() { try { if (!this.allowedNamespaces.length) { // why not checking accessible as well? return []; }

Agreed, but if getAllowedResources is only ever called after getAllowedNamespaces it "just works"

There are lots of things I would like to change to cluster.ts and the above it part of it but I don't think that it is in scope for this PR.

I don't really like the idea of yet-another-public-observable because it will go to the extension API and is really hard to take away later. Any possibility that we could resolve this from the existing information (as we did before)?

src/renderer/api/kube-watch-api.ts

ixrock · 2021-02-11T16:41:40Z

src/renderer/api/kube-watch-api.ts

+        if (typeof preloading === "object") {
+          preloading.cancelLoading();
+        }


Suggested change

if (typeof preloading === "object") {

preloading.cancelLoading();

}

preloading?.cancelLoading();

See my note about the actually typing of preloading and why the old version was actually wrong.

ixrock · 2021-02-11T16:42:44Z

src/renderer/kube-object.store.ts

    return [this.api];
  }

-  subscribe(apis = this.getSubscribeApis()) {
+  async subscribe(apis?: KubeApi[]): Promise<Disposer> {


Why moving to async?

See my note

src/renderer/utils/index.ts

src/renderer/components/+namespaces/namespace.store.ts

Signed-off-by: Sebastian Malton <sebastian@malton.name>

Fix: loading in namespaces under reduced RBAC

aed51c1

- don't assume that loading "all namespaces" that lens knows about is the same as loading "all namespaces" that exist on the cluster - Track when actually listing namespaces Signed-off-by: Sebastian Malton <sebastian@malton.name>

Nokel81 added the bug Something isn't working label Feb 11, 2021

Nokel81 requested a review from a team February 11, 2021 16:11

Nokel81 self-assigned this Feb 11, 2021

Nokel81 commented Feb 11, 2021

View reviewed changes

ixrock previously approved these changes Feb 11, 2021

View reviewed changes

resolve review comments

80352f5

Signed-off-by: Sebastian Malton <sebastian@malton.name>

Nokel81 dismissed ixrock’s stale review via 80352f5 February 11, 2021 16:52

Nokel81 requested a review from ixrock February 11, 2021 16:52

jakolehm mentioned this pull request Feb 12, 2021

Fix accessible namespaces functionality under restrictive RBAC #2138

Merged

jakolehm closed this in #2138 Feb 12, 2021

Nokel81 deleted the issue-2111 branch February 12, 2021 13:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: loading in namespaces under reduced RBAC #2130

Fix: loading in namespaces under reduced RBAC #2130

Nokel81 commented Feb 11, 2021 •

edited

Nokel81 Feb 11, 2021

Nokel81 Feb 11, 2021

Nokel81 Feb 11, 2021

Nokel81 Feb 11, 2021

Nokel81 Feb 11, 2021

ixrock Feb 11, 2021

Nokel81 Feb 11, 2021

ixrock Feb 11, 2021

Nokel81 Feb 11, 2021

ixrock Feb 11, 2021

Nokel81 Feb 11, 2021

ixrock Feb 11, 2021

Nokel81 Feb 11, 2021

Nokel81 Feb 11, 2021

jakolehm Feb 12, 2021

ixrock Feb 11, 2021

Nokel81 Feb 11, 2021

ixrock Feb 11, 2021

Nokel81 Feb 11, 2021

		unsubscribeList.forEach(unsubscribe => unsubscribe());
		unsubscribeList.length = 0;

Fix: loading in namespaces under reduced RBAC #2130

Fix: loading in namespaces under reduced RBAC #2130

Conversation

Nokel81 commented Feb 11, 2021 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Nokel81 commented Feb 11, 2021 •

edited