Skip to content
This repository has been archived by the owner on Jan 19, 2023. It is now read-only.

Use namespace scoped informers under restricted rbac #2923

Merged
merged 1 commit into from
Oct 6, 2021

Conversation

GuessWhoSamFoo
Copy link
Contributor

What this PR does / why we need it:
This PR allows a user to see resources under cases where namespaces are restricted (e.g. no list, but given access to one or more namespaces on start).

Which issue(s) this PR fixes

Special notes for your reviewer:
For simplicity, we will assume list/watch/get is the minimum needed for a given resource with the exception of namespaces.

There are a few cases to consider:

  • A user has access to a namespace and only can list a specific type of resource
  • User provides a list of namespaces, with only some valid
  • With no restrictions, generic informers should be used to avoid excessive overhead

Signed-off-by: Sam Foo [email protected]

internal/api/content_manager.go Outdated Show resolved Hide resolved
internal/api/content_manager.go Outdated Show resolved Hide resolved
internal/api/poller.go Outdated Show resolved Hide resolved
internal/cluster/namespace.go Outdated Show resolved Hide resolved
internal/objectstore/dynamic_cache.go Show resolved Hide resolved
@GuessWhoSamFoo GuessWhoSamFoo merged commit 3c89689 into vmware-archive:master Oct 6, 2021
@GuessWhoSamFoo GuessWhoSamFoo deleted the issue-2900 branch October 6, 2021 15:26
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Use namespace scoped informers when namespaces-list is provided.
3 participants