Fix allowed resources checks on GKE (#6657)

* Add check for incomplete SelfSubjectRulesReview to fix GKE

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Adding namespaced for KubeApiResource

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Refactoring of AuthorizationNamespaceReview

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Removing dead code

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Refactoring ListApiResources

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Extract ClusterContext into deps for KubeObjectStore to fix circular import

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix remaining type errors

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix crash in frame by consolidating setup into runnables

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix type errors and remove dead code

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix core resources not showing up

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix namespaces not being shown

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Simplify ClusterContext to remove something only NamespaceStore needs

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Make sure the public API doesn't change

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix lint

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fixing namespace-select-filter tests

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix other tests requiring overrides

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix kludge in cluster-frame tests

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix remaining test failures

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix integration test due to incorrect casting

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix integration test and kube watches not working at all

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix secret details test

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix lint

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix non-ApplicationBuilder tests by adding overrides

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix crash due to trying to read hostedCluster too soon

Signed-off-by: Sebastian Malton <sebastian@malton.name>

* Fix crash due to timing issues
- Make injectable phases more explicit for renderer

Signed-off-by: Sebastian Malton <sebastian@malton.name>

Signed-off-by: Sebastian Malton <sebastian@malton.name>

src/common/front-end-routing/routes/cluster/config/config-maps/config-maps-route.injectable.ts

@@ -3,22 +3,19 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const configMapsRouteInjectable = getInjectable({
   id: "config-maps-route",
-
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "configmaps");
-
-    return {
-      path: "/configmaps",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
-
+  instantiate: (di) => ({
+    path: "/configmaps",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "configmaps",
+      group: "v1",
+    }),
+  }),
   injectionToken: frontEndRouteInjectionToken,
 });
 

src/common/front-end-routing/routes/cluster/config/horizontal-pod-autoscalers/horizontal-pod-autoscalers-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const horizontalPodAutoscalersRouteInjectable = getInjectable({
   id: "horizontal-pod-autoscalers-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "horizontalpodautoscalers");
-
-    return {
-      path: "/hpa",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/hpa",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "horizontalpodautoscalers",
+      group: "autoscaling",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/config/leases/leases-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const leasesRouteInjectable = getInjectable({
   id: "leases",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "leases");
-
-    return {
-      path: "/leases",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/leases",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "leases",
+      group: "coordination.k8s.io",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/config/limit-ranges/limit-ranges-route.injectable.ts

@@ -3,24 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const limitRangesRouteInjectable = getInjectable({
   id: "limit-ranges-route",
 
-  instantiate: (di) => {
-    const limitRangesIsAllowed = di.inject(
-      isAllowedResourceInjectable,
-      "limitranges",
-    );
-
-    return {
-      path: "/limitranges",
-      clusterFrame: true,
-      isEnabled: limitRangesIsAllowed,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/limitranges",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "limitranges",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/config/pod-disruption-budgets/pod-disruption-budgets-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const podDisruptionBudgetsRouteInjectable = getInjectable({
   id: "pod-disruption-budgets-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "poddisruptionbudgets");
-
-    return {
-      path: "/poddisruptionbudgets",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/poddisruptionbudgets",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "poddisruptionbudgets",
+      group: "policy",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/config/priority-classes/priority-classes-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const priorityClassesRouteInjectable = getInjectable({
   id: "priority-classes-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "priorityclasses");
-
-    return {
-      path: "/priorityclasses",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/priorityclasses",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "priorityclasses",
+      group: "scheduling.k8s.io",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/config/resource-quotas/resource-quotas-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const resourceQuotasRouteInjectable = getInjectable({
   id: "resource-quotas-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "resourcequotas");
-
-    return {
-      path: "/resourcequotas",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/resourcequotas",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "resourcequotas",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/config/runtime-classes/runtime-classes-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const runtimeClassesRouteInjectable = getInjectable({
   id: "runtime-classes-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "runtimeclasses");
-
-    return {
-      path: "/runtimeclasses",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/runtimeclasses",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "runtimeclasses",
+      group: "node.k8s.io",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/config/secrets/secrets-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const secretsRouteInjectable = getInjectable({
   id: "secrets-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "secrets");
-
-    return {
-      path: "/secrets",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/secrets",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "secrets",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/events/events-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../front-end-route-injection-token";
 
 const eventsRouteInjectable = getInjectable({
   id: "events-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "events");
-
-    return {
-      path: "/events",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/events",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "events",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/namespaces/namespaces-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../front-end-route-injection-token";
 
 const namespacesRouteInjectable = getInjectable({
   id: "namespaces-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "namespaces");
-
-    return {
-      path: "/namespaces",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/namespaces",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "namespaces",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/network/endpoints/endpoints-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const endpointsRouteInjectable = getInjectable({
   id: "endpoints-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "endpoints");
-
-    return {
-      path: "/endpoints",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/endpoints",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "endpoints",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/network/ingresses/ingresses-route.injectable.ts

@@ -3,21 +3,27 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
+import { computedOr } from "../../../../../utils/computed-or";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const ingressesRouteInjectable = getInjectable({
   id: "ingresses-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "ingresses");
-
-    return {
-      path: "/ingresses",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/ingresses",
+    clusterFrame: true,
+    isEnabled: computedOr(
+      di.inject(shouldShowResourceInjectionToken, {
+        apiName: "ingresses",
+        group: "networking.k8s.io",
+      }),
+      di.inject(shouldShowResourceInjectionToken, {
+        apiName: "ingresses",
+        group: "extensions",
+      }),
+    ),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/network/network-policies/network-policies-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const networkPoliciesRouteInjectable = getInjectable({
   id: "network-policies-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "networkpolicies");
-
-    return {
-      path: "/network-policies",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/network-policies",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "networkpolicies",
+      group: "networking.k8s.io",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/network/services/services-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const servicesRouteInjectable = getInjectable({
   id: "services-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "services");
-
-    return {
-      path: "/services",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/services",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "services",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/nodes/nodes-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../front-end-route-injection-token";
 
 const nodesRouteInjectable = getInjectable({
   id: "nodes-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "nodes");
-
-    return {
-      path: "/nodes",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/nodes",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "nodes",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/overview/cluster-overview-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../front-end-route-injection-token";
 
 const clusterOverviewRouteInjectable = getInjectable({
   id: "cluster-overview-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "nodes");
-
-    return {
-      path: "/overview",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/overview",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "nodes",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/storage/persistent-volume-claims/persistent-volume-claims-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const persistentVolumeClaimsRouteInjectable = getInjectable({
   id: "persistent-volume-claims-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "persistentvolumeclaims");
-
-    return {
-      path: "/persistent-volume-claims",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/persistent-volume-claims",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "persistentvolumeclaims",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/storage/persistent-volumes/persistent-volumes-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const persistentVolumesRouteInjectable = getInjectable({
   id: "persistent-volumes-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "persistentvolumes");
-
-    return {
-      path: "/persistent-volumes",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/persistent-volumes",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "persistentvolumes",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/storage/storage-classes/storage-classes-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const storageClassesRouteInjectable = getInjectable({
   id: "storage-classes-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "storageclasses");
-
-    return {
-      path: "/storage-classes",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/storage-classes",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "storageclasses",
+      group: "storage.k8s.io",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/user-management/cluster-role-bindings/cluster-role-bindings-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const clusterRoleBindingsRouteInjectable = getInjectable({
   id: "cluster-role-bindings-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "clusterrolebindings");
-
-    return {
-      path: "/cluster-role-bindings",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/cluster-role-bindings",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "clusterrolebindings",
+      group: "rbac.authorization.k8s.io",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/user-management/cluster-roles/cluster-roles-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const clusterRolesRouteInjectable = getInjectable({
   id: "cluster-roles-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "clusterroles");
-
-    return {
-      path: "/cluster-roles",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/cluster-roles",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "clusterroles",
+      group: "rbac.authorization.k8s.io",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/user-management/pod-security-policies/pod-security-policies-route.injectable.ts

@@ -3,19 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const podSecurityPoliciesRouteInjectable = getInjectable({
   id: "pod-security-policies-route",
 
   instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "podsecuritypolicies");
-
     return {
       path: "/pod-security-policies",
       clusterFrame: true,
-      isEnabled: isAllowedResource,
+      isEnabled: di.inject(shouldShowResourceInjectionToken, {
+        apiName: "podsecuritypolicies",
+        group: "policy",
+      }),
     };
   },
 

src/common/front-end-routing/routes/cluster/user-management/role-bindings/role-bindings-route.injectable.ts

@@ -3,19 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const roleBindingsRouteInjectable = getInjectable({
   id: "role-bindings-route",
 
   instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "rolebindings");
-
     return {
       path: "/role-bindings",
       clusterFrame: true,
-      isEnabled: isAllowedResource,
+      isEnabled: di.inject(shouldShowResourceInjectionToken, {
+        apiName: "rolebindings",
+        group: "rbac.authorization.k8s.io",
+      }),
     };
   },
 

src/common/front-end-routing/routes/cluster/user-management/roles/roles-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const rolesRouteInjectable = getInjectable({
   id: "roles-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "roles");
-
-    return {
-      path: "/roles",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/roles",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "roles",
+      group: "rbac.authorization.k8s.io",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/user-management/service-accounts/service-accounts-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const serviceAccountsRouteInjectable = getInjectable({
   id: "service-accounts-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "serviceaccounts");
-
-    return {
-      path: "/service-accounts",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/service-accounts",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "serviceaccounts",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/workloads/cron-jobs/cron-jobs-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const cronJobsRouteInjectable = getInjectable({
   id: "cron-jobs-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "cronjobs");
-
-    return {
-      path: "/cronjobs",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/cronjobs",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "cronjobs",
+      group: "batch",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/workloads/daemonsets/daemonsets-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const daemonsetsRouteInjectable = getInjectable({
   id: "daemonsets-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "daemonsets");
-
-    return {
-      path: "/daemonsets",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/daemonsets",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "daemonsets",
+      group: "apps",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/workloads/deployments/deployments-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const deploymentsRouteInjectable = getInjectable({
   id: "deployments-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "deployments");
-
-    return {
-      path: "/deployments",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/deployments",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "deployments",
+      group: "apps",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/workloads/jobs/jobs-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const jobsRouteInjectable = getInjectable({
   id: "jobs-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "jobs");
-
-    return {
-      path: "/jobs",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/jobs",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "jobs",
+      group: "batch",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/workloads/pods/pods-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const podsRouteInjectable = getInjectable({
   id: "pods-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "pods");
-
-    return {
-      path: "/pods",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/pods",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "pods",
+      group: "v1",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/workloads/replicasets/replicasets-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const replicasetsRouteInjectable = getInjectable({
   id: "replicasets-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "replicasets");
-
-    return {
-      path: "/replicasets",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/replicasets",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "replicasets",
+      group: "apps",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });

src/common/front-end-routing/routes/cluster/workloads/statefulsets/statefulsets-route.injectable.ts

@@ -3,21 +3,20 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 import { getInjectable } from "@ogre-tools/injectable";
-import isAllowedResourceInjectable from "../../../../../utils/is-allowed-resource.injectable";
+import { shouldShowResourceInjectionToken } from "../../../../../cluster-store/allowed-resources-injection-token";
 import { frontEndRouteInjectionToken } from "../../../../front-end-route-injection-token";
 
 const statefulsetsRouteInjectable = getInjectable({
   id: "statefulsets-route",
 
-  instantiate: (di) => {
-    const isAllowedResource = di.inject(isAllowedResourceInjectable, "statefulsets");
-
-    return {
-      path: "/statefulsets",
-      clusterFrame: true,
-      isEnabled: isAllowedResource,
-    };
-  },
+  instantiate: (di) => ({
+    path: "/statefulsets",
+    clusterFrame: true,
+    isEnabled: di.inject(shouldShowResourceInjectionToken, {
+      apiName: "statefulsets",
+      group: "apps",
+    }),
+  }),
 
   injectionToken: frontEndRouteInjectionToken,
 });