Replace admin check with check for access (#297)

Signed-off-by: Adam Malcontenti-Wilson <adman.com@gmail.com>

src/main/cluster.ts

@@ -3,7 +3,7 @@ import { FeatureStatusMap } from "./feature"
 import * as k8s from "./k8s"
 import { clusterStore } from "../common/cluster-store"
 import logger from "./logger"
-import { KubeConfig, CoreV1Api } from "@kubernetes/client-node"
+import { KubeConfig, CoreV1Api, AuthorizationV1Api, V1ResourceAttributes } from "@kubernetes/client-node"
 import * as fm from "./feature-manager";
 import { Kubectl } from "./kubectl";
 import { PromiseIpc } from "electron-promise-ipc"
@@ -137,9 +137,7 @@ export class Cluster implements ClusterInfo {
       this.distribution = this.detectKubernetesDistribution(this.version)
       this.features = await fm.getFeatures(this.contextHandler)
       this.isAdmin = await this.isClusterAdmin()
-      if (this.isAdmin) {
-        this.nodes = await this.getNodeCount()
-      }
+      this.nodes = await this.getNodeCount()
       this.kubeCtl = new Kubectl(this.version)
       this.kubeCtl.ensureKubectl()
     }
@@ -227,30 +225,29 @@ export class Cluster implements ClusterInfo {
     }
   }
 
-  protected async isClusterAdmin(): Promise<boolean> {
-    const requestOpts: request.RequestPromiseOptions = {
-      body: {
-        kind: "SelfSubjectAccessReview",
-        apiVersion: "authorization.k8s.io/v1",
-        spec: {
-          resourceAttributes: {
-            namespace: "kube-system",
-            resource: "*",
-            verb: "create",
-          }
-        }
-      },
-      method: "post"
-    }
+  public async canI(resourceAttributes: V1ResourceAttributes): Promise<boolean> {
+    const authApi = this.contextHandler.kc.makeApiClient(AuthorizationV1Api)
     try {
-      const response = await this.k8sRequest("/apis/authorization.k8s.io/v1/selfsubjectaccessreviews", requestOpts)
-      return response.status.allowed === true
+      const accessReview = await authApi.createSelfSubjectAccessReview({
+        apiVersion: "authorization.k8s.io/v1",
+        kind: "SelfSubjectAccessReview",
+        spec: { resourceAttributes }
+      })
+      return accessReview.body.status.allowed === true
     } catch(error) {
       logger.error(`failed to request selfSubjectAccessReview: ${error.message}`)
       return false
     }
   }
 
+  protected async isClusterAdmin(): Promise<boolean> {
+    return this.canI({
+      namespace: "kube-system",
+      resource: "*",
+      verb: "create",
+    })
+  }
+
   protected detectKubernetesDistribution(kubernetesVersion: string): string {
     if (kubernetesVersion.includes("gke")) {
       return "gke"

src/main/routes/config.ts

@@ -5,33 +5,19 @@ import { getAppVersion } from "../../common/app-utils"
 import { CoreV1Api, AuthorizationV1Api } from "@kubernetes/client-node"
 import { Cluster } from "../cluster"
 
-
-function selfSubjectAccessReview(authApi: AuthorizationV1Api, namespace: string) {
-  return authApi.createSelfSubjectAccessReview({
-    apiVersion: "authorization.k8s.io/v1",
-    kind: "SelfSubjectAccessReview",
-    spec: {
-      resourceAttributes: {
-        namespace: namespace,
-        resource: "pods",
-        verb: "list",
-      }
-    }
-  })
-}
-
 async function getAllowedNamespaces(cluster: Cluster) {
   const api = cluster.contextHandler.kc.makeApiClient(CoreV1Api)
-  const authApi = cluster.contextHandler.kc.makeApiClient(AuthorizationV1Api)
   try {
     const namespaceList = await api.listNamespace()
     const nsAccessStatuses = await Promise.all(
-      namespaceList.body.items.map(ns => {
-        return selfSubjectAccessReview(authApi, ns.metadata.name)
-      })
+      namespaceList.body.items.map(ns => cluster.canI({
+        namespace: ns.metadata.name,
+        resource: "pods",
+        verb: "list",
+      }))
     )
     return namespaceList.body.items
-      .filter((ns, i) => nsAccessStatuses[i].body.status.allowed)
+      .filter((ns, i) => nsAccessStatuses[i])
       .map(ns => ns.metadata.name)
   } catch(error) {
     const kc = cluster.contextHandler.kc
@@ -44,6 +30,26 @@ async function getAllowedNamespaces(cluster: Cluster) {
   }
 }
 
+async function getAllowedResources(cluster: Cluster) {
+  // TODO: auto-populate all resources dynamically
+  const resources = [
+    "nodes", "persistentvolumes", "storageclasses", "customresourcedefinitions",
+    "podsecuritypolicies"
+  ]
+  try {
+    const resourceAccessStatuses = await Promise.all(
+      resources.map(resource => cluster.canI({
+        resource: resource,
+        verb: "list"
+      }))
+    )
+    return resources
+      .filter((resource, i) => resourceAccessStatuses[i])
+  } catch(error) {
+    return []
+  }
+}
+
 class ConfigRoute extends LensApi {
 
   public async routeConfig(request: LensApiRequest) {
@@ -56,6 +62,7 @@ class ConfigRoute extends LensApi {
       kubeVersion: cluster.version,
       chartsEnabled: true,
       isClusterAdmin: cluster.isAdmin,
+      allowedResources: await getAllowedResources(cluster),
       allowedNamespaces: await getAllowedNamespaces(cluster)
     };