search

GoogleCloudPlatform / cloud-code-intellij

Plugin to support the Google Cloud Platform in IntelliJ IDEA - Docs and Issues Repository
Apache License 2.0
319 stars 59 forks source link

Unable to use Kubernetes Explorer without permission to read namespaces #3073

Open horodchukanton opened 2 years ago

horodchukanton commented 2 years ago

Expected Behavior

According to https://github.com/GoogleCloudPlatform/cloud-code-intellij/issues/2697, the context's namespace should be used by default and I should see a list of deployments(/pods/replicasets?)

Actual Behavior

Plugin fails to build a list of available namespaces, because I don't have a permission to list the namespaces.

Знімок екрана 2022-04-13 о 13 40 43

Additional Information

Context definition in .kube/config

  contexts:
  - context:
      cluster: te[hidden].com
      namespace: shipping
      user: oidc
    name: te[hidden].com
  current-context: te[hidden].com
horodchukanton commented 2 years ago

Would be happy to share more information if necessary

etanshaul commented 2 years ago

Hello. Just to confirm, when you run kubectl get namespaces you also get permission errors right? I think this is a limitation currently in our plugin that has come up before, and we will explore options to resolve this. cc @ivanporty in case I missed something.

horodchukanton commented 2 years ago

@etanshaul Yes, I receive the same error on CLI

[hidden]@MacBook-Pro ~ % kubectl get namespaces
Error from server (Forbidden): namespaces is forbidden: User "[hidden]" cannot list resource "namespaces" in API group "" at the cluster scope

And as in the mentioned issue (https://github.com/GoogleCloudPlatform/cloud-code-intellij/issues/2697), I can retrieve the namespace configured in the .kube/config

[hidden]@MacBook-Pro ~ % kubectl config view -o jsonpath='{.contexts[0].context.namespace}'
shipping
etanshaul commented 2 years ago

Sounds good. thanks. I am going to leave this issue open to track progress here. We'll circle back with questions / updates.

horodchukanton commented 2 years ago

Update: Same error on latest version (22.4.1-213)

ivanporty commented 2 years ago

Thanks for the report @horodchukanton! This is a limitation of our cluster explorer at the moment - we assume we can read namespaces in the cluster to proceed. We might be coming with the current context view only too sometime in the future - this should work for you - you can see your current context (and its namespace) resources, as long as you don't access other namespaces, right?

horodchukanton commented 2 years ago

@ivanporty Thanks for the response ) Yep, it will work for me

I understand that {.contexts[0].context.namespace} will work with a single namespace per context and if I will have permissions for two of them, I'll have to use separate contexts for each (if that's possible). But, I'm not familiar enough with Kubernetes to suggest a better solution.

horodchukanton commented 2 years ago

UPD. This is how Kubernetes plugin deals with the problem

image
ivanporty commented 2 years ago

Thank you @horodchukanton, this is a good suggestion. We are planning to work on it some time soon to allow your use case in our Kubernetes Explorer, and post updates here in this issue.