feat: auto respect rbac for discovery/sync #532
Conversation
Signed-off-by: Soumya Ghosh Dastidar <gdsoumya@gmail.com>
Signed-off-by: Soumya Ghosh Dastidar <gdsoumya@gmail.com>
Signed-off-by: Soumya Ghosh Dastidar <gdsoumya@gmail.com>
Signed-off-by: Soumya Ghosh Dastidar <gdsoumya@gmail.com>
Codecov ReportPatch coverage:
Additional details and impacted files@@ Coverage Diff @@
## master #532 +/- ##
==========================================
- Coverage 55.63% 54.67% -0.97%
==========================================
Files 41 41
Lines 4553 4635 +82
==========================================
+ Hits 2533 2534 +1
- Misses 1825 1905 +80
- Partials 195 196 +1
☔ View full report in Codecov by Sentry. |
| clientset, err := kubernetes.NewForConfig(config) | ||
| if err != nil { | ||
| return err | ||
| } |
There was a problem hiding this comment.
Instead of creating a new client here for the core API, could we not just reuse the existing dynamic client and then call it something like client.Resource(schema.FromAPIVersionAndKind("authorization.k8s.io/v1", "SelfSubjectAccessReviews").Create() below? Creating a new client imho has some side-effects (i.e. a new client-side rate limiter etc).
If there's a specific reason for using a new client, a comment would be nice as to why.
There was a problem hiding this comment.
No specific reason, I thought of using the concrete type instead of using dynamic client. Will test out with dynamic client instead.
There was a problem hiding this comment.
Tested it with dynamic client and for some reason the request to create the access review resource failed with an unauthorized error. I wasn't able to determine why it was happening but my best guess is the dynamic client needs a namespace for creating the resource, but access review is a cluster scope resource so when I pass "" as the namespace it fails the request.
gdsoumya
force-pushed
the
feat/respect_rbac
branch
4 times, most recently
from
05917b9
to
4049709
Compare
Signed-off-by: Soumya Ghosh Dastidar <gdsoumya@gmail.com>
gdsoumya
force-pushed
the
feat/respect_rbac
branch
from
4049709
to
9b1f75b
Compare
|
Kudos, SonarCloud Quality Gate passed!
|
This PR implements this proposal. PR enables gitops engine to automatically stop watching for resources that it does not have permission to access without having to manually set resource exclusions.