Fix allowed resources checks on GKE (#6657)

* Add check for incomplete SelfSubjectRulesReview to fix GKE Signed-off-by: Sebastian Malton <sebastian@malton.name> * Adding namespaced for KubeApiResource Signed-off-by: Sebastian Malton <sebastian@malton.name> * Refactoring of AuthorizationNamespaceReview Signed-off-by: Sebastian Malton <sebastian@malton.name> * Removing dead code Signed-off-by: Sebastian Malton <sebastian@malton.name> * Refactoring ListApiResources Signed-off-by: Sebastian Malton <sebastian@malton.name> * Extract ClusterContext into deps for KubeObjectStore to fix circular import Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix remaining type errors Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix crash in frame by consolidating setup into runnables Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix type errors and remove dead code Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix core resources not showing up Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix namespaces not being shown Signed-off-by: Sebastian Malton <sebastian@malton.name> * Simplify ClusterContext to remove something only NamespaceStore needs Signed-off-by: Sebastian Malton <sebastian@malton.name> * Make sure the public API doesn't change Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix lint Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fixing namespace-select-filter tests Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix other tests requiring overrides Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix kludge in cluster-frame tests Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix remaining test failures Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix integration test due to incorrect casting Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix integration test and kube watches not working at all Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix secret details test Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix lint Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix non-ApplicationBuilder tests by adding overrides Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix crash due to trying to read hostedCluster too soon Signed-off-by: Sebastian Malton <sebastian@malton.name> * Fix crash due to timing issues - Make injectable phases more explicit for renderer Signed-off-by: Sebastian Malton <sebastian@malton.name> Signed-off-by: Sebastian Malton <sebastian@malton.name>
2025-05-20 05:10:56 +00:00 · 2022-12-20 17:20:27 +02:00
1 parent e36f3d2d70
commit 443081493b
@@ -15,6 +15,12 @@ import type { ResourceApplyingStack } from "../../common/k8s/resource-stack";
 import { asLegacyGlobalFunctionForExtensionApi } from "../as-legacy-globals-for-extension-api/as-legacy-global-function-for-extension-api";
 import { asLegacyGlobalForExtensionApi } from "../as-legacy-globals-for-extension-api/as-legacy-global-object-for-extension-api";
 import type { KubernetesCluster } from "./catalog";
+import type { KubeApiDataFrom, KubeObjectStoreOptions } from "../../common/k8s-api/kube-object.store";
+import { KubeObjectStore as InternalKubeObjectStore } from "../../common/k8s-api/kube-object.store";
+import type { KubeJsonApiDataFor, KubeObject } from "../../common/k8s-api/kube-object";
+import type { KubeApi } from "../../common/k8s-api/kube-api";
+import clusterFrameContextForNamespacedResourcesInjectable from "../../renderer/cluster-frame-context/for-namespaced-resources.injectable";
+import type { ClusterContext } from "../../renderer/cluster-frame-context/cluster-frame-context";

 export const apiManager = asLegacyGlobalForExtensionApi(apiManagerInjectable);
 export const forCluster = asLegacyGlobalFunctionForExtensionApi(createKubeApiForClusterInjectable);
@@ -72,8 +78,44 @@ export {
  type KubeJsonApiData,
 } from "../../common/k8s-api/kube-json-api";

+export abstract class KubeObjectStore<
+  K extends KubeObject = KubeObject,
+  A extends KubeApi<K, D> = KubeApi<K, KubeJsonApiDataFor<K>>,
+  D extends KubeJsonApiDataFor<K> = KubeApiDataFrom<K, A>,
+> extends InternalKubeObjectStore<K, A, D> {
+  /**
+   * @deprecated This is no longer used and shouldn't have been every really used
+   */
+  static readonly context = {
+    set: (ctx: ClusterContext) => {
+      console.warn("Setting KubeObjectStore.context is no longer supported");
+      void ctx;
+    },
+    get: () => asLegacyGlobalForExtensionApi(clusterFrameContextForNamespacedResourcesInjectable),
+  };
+
+  get context() {
+    return this.dependencies.context;
+  }
+
+  constructor(api: A, opts?: KubeObjectStoreOptions);
+  /**
+   * @deprecated Supply API instance through constructor
+   */
+  constructor();
+  constructor(api?: A, opts?: KubeObjectStoreOptions) {
+    super(
+      {
+        context: asLegacyGlobalForExtensionApi(clusterFrameContextForNamespacedResourcesInjectable),
+      },
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+      api!,
+      opts,
+    );
+  }
+}
+
 export {
-  KubeObjectStore,
  type JsonPatch,
  type KubeObjectStoreLoadAllParams,
  type KubeObjectStoreLoadingParams,
@@ -3,8 +3,7 @@
 * Licensed under MIT License. See LICENSE in root directory for more information.
 */
 import type { KubeResource } from "../../common/rbac";
-import isAllowedResourceInjectable from "../../common/utils/is-allowed-resource.injectable";
-import { castArray } from "lodash/fp";
+import { apiResourceRecord } from "../../common/rbac";
 import { getLegacyGlobalDiForExtensionApi } from "../as-legacy-globals-for-extension-api/legacy-global-di-for-extension-api";
 import clusterRoleBindingApiInjectable from "../../common/k8s-api/endpoints/cluster-role-binding.api.injectable";
 import clusterRoleApiInjectable from "../../common/k8s-api/endpoints/cluster-role.api.injectable";
@@ -37,13 +36,22 @@ import namespaceApiInjectable from "../../common/k8s-api/endpoints/namespace.api
 import kubeEventApiInjectable from "../../common/k8s-api/endpoints/events.api.injectable";
 import roleBindingApiInjectable from "../../common/k8s-api/endpoints/role-binding.api.injectable";
 import customResourceDefinitionApiInjectable from "../../common/k8s-api/endpoints/custom-resource-definition.api.injectable";
+import { shouldShowResourceInjectionToken } from "../../common/cluster-store/allowed-resources-injection-token";

-export function isAllowedResource(resource: KubeResource | KubeResource[]) {
-  const resources = castArray(resource);
+export function isAllowedResource(resources: KubeResource | KubeResource[]) {
  const di = getLegacyGlobalDiForExtensionApi();

-  return resources.every((resourceName: any) => {
-    const _isAllowedResource = di.inject(isAllowedResourceInjectable, resourceName);
+  return [resources].flat().every((resourceName) => {
+    const resource = apiResourceRecord[resourceName];
+
+    if (!resource) {
+      return true;
+    }
+
+    const _isAllowedResource = di.inject(shouldShowResourceInjectionToken, {
+      apiName: resourceName,
+      group: resource.group,
+    });

    // Note: Legacy isAllowedResource does not advertise reactivity
    return _isAllowedResource.get();