search

headlamp-k8s / headlamp

A Kubernetes web UI that is fully-featured, user-friendly and extensible
https://headlamp.dev
Apache License 2.0
2.22k stars 156 forks source link

Namespace-Level Permission Check if Cluster-level fail #1195

Open Jaguar-Kwok opened 1 year ago

Jaguar-Kwok commented 1 year ago

If a user lacks permission to access all pods at the cluster level, the system should attempt to verify the user's permissions at the namespace level. If the user has the necessary permissions, the relevant pods should be displayed, rather than presenting a 'no permission' message, especially the user have GET cluster-level namespace permission but not GET cluster-level pod permission.

joaquimrocha commented 1 year ago

@Jaguar-Kwok , if you do not have access for all namespaces, you can set up your accessible namespaces in the cluster settings. Does this help your case?

Jaguar-Kwok commented 1 year ago

@joaquimrocha Thank you for your reply. Yes, I am using the method mentioned. However the reason I would like to propose an enhancement is because currently, I have a group of users who need access to about 30 namespaces per cluster and across multiple clusters and URLs. Adding each namespace individually is time-consuming and cumbersome. To improve the user experience, I suggest implementing an automated namespace permission discovery or allowing the addition of multiple namespaces at once, using a semicolon (;) as the delimiter.

joaquimrocha commented 1 year ago

@Jaguar-Kwok , I see. Given that one may not have the permissions to list all namespaces, I am not sure an auto detection would work. But we can add the comma separated parsing.

Also, if you have a group of users that are using Headlamp, you can create a plugin that simply adds a certain list of namespaces as the allowed ones, so all users will have this list by default at least. This can be done by setting the cluster settings with the allowed namespaces there. But maybe we can make this easier by exporting some of the helper functions to accomplish this.

Garagoth commented 1 month ago

I would definitely expect that if user CAN list all namespaces and CAN list pods in some of those namespaces then he can see only namespaces where he has any permissions and pods from those namespaces ass well. Without any configuration from user like entering namespaces that he is supposed to see.

Garagoth commented 1 month ago

Also I think this is connected with #752.