Application of `selector`s locally scales badly

[richard-cox]

Blocked on https://github.com/rancher/rancher/issues/46333

• In places the UI fetches all of a resource and then filters by selector
  • see shell/utils/selector.js, in particular matches and matching
  • these are used in specific places but also findMatching if all resources have been fetched
• Fetching all of a resource is bad and we need to fix this
• Need to look at each use case and find a better way
  • in places we could just make an api request with ~labelSelector~ new filter=metadata.label instead
  • in other places individual resources each apply a selector to all resources (we couldn't just make a single request with a single selector)
• Notable Parts
  • findMatching action
  • vue store action that will make an API request with the given selector
  • matching getter
  • vue store getter that will provide resources from cache that match the given selector
  • MatchExpressions
  • Component that creates a selector
  • ResourceSelector
  • Wraps MatchExpression, showing resources that match it's selector
  • selector.js helper functions
  • matches - does the given resource match the selector
  • matching - apply the given selector to the given resources
• Specific cases
  • findMatching action (with selector)
  • shell/plugins/dashboard-store/resource-class.js
    • _findRelationship. selector from _relationshipsFor --> metadata.relationships[].selector
    • only used by shell/models/cis.cattle.io.clusterscan.js to find owned cluster scan CIS reports (cis.cattle.io.clusterscanreport)
    • Action: Remove generic handling
    • Action: Implement using API + selector
  • shell/pages/c/_cluster/longhorn/index.vue
    • services with label app=longhorn-ui
    • Action: Implement with API + label filtering
  • shell/pages/c/_cluster/uiplugins/CatalogList/CatalogUninstallDialog.vue
    • deployment, service, helm repo with specific label
    • Action: Implement with API + label filtering
  • shell/plugins/steve/subscribe.js
    • resyncing values (forced new request)
    • also uses matching getter --> selector.js matching
    • Action: Depends on clusterscan above
  • selector.js matches
  • shell/components/SortableTable/filtering.js handleStringSearch
    • converts sortable table search string to a selector, applies checks row
    • Action: None
  • shell/detail/workload/index.vue findMatchingServices
    • workload detail page. finds services associated with pods in a workload (service.spec.selector)
    • services shown on page
      • Action: Implement using API + selector
    • used to find ingresses (also shown on page)
      • Action: Implement using API + selector
  • shell/models/workload.js pods
    • find pods associated with workload (finds relationships that are pods, applies that selector to pods)
    • Action: Implement using API + selector
    • workload detail page
      • pod restarts
      • pod guages
      • job guages
      • services list
      • pods list
  • selector.js matching
  • shell/components/form/ResourceSelector.vue updateMatchingResources
    • ties in a MatchExpress component with a ResourceTable
    • only used by shell/edit/policy.poddisruptionbudget.vue
    • Action: Implement using API + selector
  • shell/edit/fleet.cattle.io.clustergroup.vue updateMatchingClusters
    • find clusters for cluster group mathing selector from MatchExpressions
    • Action: Implement using API + selector
  • shell/edit/service.vue updateMatchingPods
    • finds pods for the services matching service's value.spec.selector
    • Action: Implement using API + selector
  • shell/edit/networking.k8s.io.networkpolicy/index.vue
    • finds pods for policy matching selector from MatchExpressions
    • Action: Implement using API + selector
  • shell/edit/networking.k8s.io.networkpolicy/PolicyRuleTarget.vue getMatchingPods
    • find pods for rule matching selector from MatchExpressions
    • Action: Implement using API + selector
  • shell/edit/networking.k8s.io.networkpolicy/PolicyRuleTarget.vue getMatchingNamespaces
    • find namespaces for rule matching selector from MatchExpressions
    • Action: Implement using API + selector
  • shell/models/fleet.cattle.io.bundle.js targetClusters
    • find clusters for cluster group selector
    • Action: Implement using API + selector
    • find clusters for cluster selector
    • Action: Implement using API + selector
  • shell/models/fleet.cattle.io.clustergroup.js targetClusters
    • find clusters for cluster group selector
    • Action: Implement using API + selector
  • shell/models/fleet.cattle.io.gitrepo.js
    • find clusters for cluster group selector
    • Action: Implement using API + selector
    • find clusters for cluster selector
    • Action: Implement using API + selector
  • shell/models/service.js pods
    • find pods for service matching pod selector
    • Action: Implement using API + selector
  • shell/models/workload.js
    • find pods given workloads spec.selector (used for ssh to first running pod)
    • Action: Implement using API + selector

Useful links

• https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#labelselector-v1-meta
• https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#list-and-watch-filtering
• https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#deploymentspec-v1-apps

Notes

• labelSelectors contain two parts
  • matchExpression: key - operator (in, not in, less than, etc), - values
  • matchLabel is shorthand for key - IN - values
  • https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#labelselector-v1-meta

Edit: Updates with all cases

[richard-cox]

Implementation dependent on https://github.com/rancher/rancher/issues/46333

[richard-cox]

See https://github.com/rancher/rancher/issues/46333#issuecomment-2256175260

More complex / full labelSelector support will not be included in 2.10 and are out of scope of the above linked issue.

For this release we will disable the basic use cases of selects x or y, to be enabled with full labelSelector support post 2.10 (issue pending).

If more core use cases are discovered then the above can be reviewed

Edit: More use cases have been discovered (description updated)

[richard-cox]

@moio I've updated the issue including all the places where we apply fully selectors locally. There's quite a few.

There's a lot of work there to either

• Disable all the features - I would not like to say we're production ready if so
• Convert all usages to filter via API and not locally (requires full label selector api support)

[moio]

@richard-cox: I agree this list looks too long to accept in a non-experimental version.

Disabling them while the feature is experimental does not make sense to me. Better to have a list of known regressions (or a shortlist of features expected to work) and actually address the underlying limitations.

I am adding full label selector API support to https://github.com/rancher/rancher/issues/46333.