Perform all namespace access check

Signed-off-by: Tamal Saha <[email protected]>

go.mod

@@ -49,7 +49,7 @@ require (
 	kmodules.xyz/custom-resources v0.30.0
 	kmodules.xyz/go-containerregistry v0.0.12
 	kmodules.xyz/monitoring-agent-api v0.29.0
-	kmodules.xyz/resource-metadata v0.18.13-0.20240908185540-fa8ef486973e
+	kmodules.xyz/resource-metadata v0.18.13-0.20240911040707-0451a5c4bbeb
 	kmodules.xyz/resource-metrics v0.30.4
 	kmodules.xyz/resource-metrics/utils v0.30.4
 	kmodules.xyz/sets v0.29.0

go.sum

@@ -922,8 +922,8 @@ kmodules.xyz/monitoring-agent-api v0.29.0 h1:gpFl6OZrlMLb/ySMHdREI9EwGtnJ91oZBn9
 kmodules.xyz/monitoring-agent-api v0.29.0/go.mod h1:iNbvaMTgVFOI5q2LJtGK91j4Dmjv4ZRiRdasGmWLKQI=
 kmodules.xyz/offshoot-api v0.30.0 h1:dq9F93pu4Q8rL9oTcCk+vGGy8vpS7RNt0GSwx7Bvhec=
 kmodules.xyz/offshoot-api v0.30.0/go.mod h1:o9VoA3ImZMDBp3lpLb8+kc2d/KBxioRwCpaKDfLIyDw=
-kmodules.xyz/resource-metadata v0.18.13-0.20240908185540-fa8ef486973e h1:PcKUBcb60nuswPKqb7SsVZ04Qk2S8sTyq200eX88dZ8=
-kmodules.xyz/resource-metadata v0.18.13-0.20240908185540-fa8ef486973e/go.mod h1:t1tu60j9i2EduufyYBjz7h3vPymfHb9mqv5a+EvSjzo=
+kmodules.xyz/resource-metadata v0.18.13-0.20240911040707-0451a5c4bbeb h1:7744OQAOxB96MYUa5op80/zC8KYXmtrN8AmbUwGqEmc=
+kmodules.xyz/resource-metadata v0.18.13-0.20240911040707-0451a5c4bbeb/go.mod h1:t1tu60j9i2EduufyYBjz7h3vPymfHb9mqv5a+EvSjzo=
 kmodules.xyz/resource-metrics v0.30.4 h1:8HBPtYmo9ETY91gsc55JE8Z986+3ZuRq57M0wZ9npqI=
 kmodules.xyz/resource-metrics v0.30.4/go.mod h1:w9+rz7/s/kGP1GWzYSuRdCn+l7EwpesmESSEHkLBnIQ=
 kmodules.xyz/resource-metrics/utils v0.30.4 h1:bJS/x0Qr7N1FFdxugFbzZ/Es6HVs4ptsFlhkmgj3jac=

pkg/registry/identity/selfsubjectnamespaceaccessreview/storage.go

@@ -87,6 +87,46 @@ func (r *Storage) Create(ctx context.Context, obj runtime.Object, _ rest.Validat
 		extra[k] = v
 	}
 
+	// check for all namespaces
+	{
+		allowed := true
+		var err error
+		for _, attr := range in.Spec.ResourceAttributes {
+			attr.Namespace = ""
+			review := &authorization.SelfSubjectAccessReview{
+				Spec: authorization.SelfSubjectAccessReviewSpec{
+					ResourceAttributes:    &attr,
+					NonResourceAttributes: nil,
+				},
+			}
+			review, err = r.kc.AuthorizationV1().SelfSubjectAccessReviews().Create(ctx, review, metav1.CreateOptions{})
+			if err != nil {
+				return nil, err
+			}
+			if !review.Status.Allowed {
+				allowed = false
+				break
+			}
+		}
+		for _, attr := range in.Spec.NonResourceAttributes {
+			review := &authorization.SelfSubjectAccessReview{
+				Spec: authorization.SelfSubjectAccessReviewSpec{
+					NonResourceAttributes: &attr,
+				},
+			}
+			review, err = r.kc.AuthorizationV1().SelfSubjectAccessReviews().Create(ctx, review, metav1.CreateOptions{})
+			if err != nil {
+				return nil, err
+			}
+			if !review.Status.Allowed {
+				allowed = false
+				break
+			}
+		}
+
+		in.Status.AllNamespaces = allowed
+	}
+
 	var list core.NamespaceList
 	err := r.rtc.List(ctx, &list)
 	if err != nil {
@@ -146,14 +186,18 @@ func (r *Storage) Create(ctx context.Context, obj runtime.Object, _ rest.Validat
 		}
 
 		if allowed {
+			// in.Status.Namespaces
 			allowedNs = append(allowedNs, ns)
 		}
 	}
 
 	if clustermeta.IsRancherManaged(r.rtc.RESTMapper()) {
 		projects := map[string][]string{}
 		for _, ns := range allowedNs {
-			projectId := ns.Labels[clustermeta.LabelKeyRancherFieldProjectId]
+			projectId, exists := ns.Labels[clustermeta.LabelKeyRancherFieldProjectId]
+			if !exists {
+				projectId = clustermeta.FakeRancherProjectId
+			}
 			projects[projectId] = append(projects[projectId], ns.Name)
 		}
 

vendor/kmodules.xyz/resource-metadata/apis/identity/v1alpha1/selfsubjectnamespaceaccessreview.go

@@ -64,8 +64,9 @@ type SelfSubjectNamespaceAccessReviewSpec struct {
 }
 
 type SubjectAccessNamespaceReviewStatus struct {
-	Namespaces []string            `json:"namespaces,omitempty"`
-	Projects   map[string][]string `json:"projects,omitempty"`
+	AllNamespaces bool                `json:"allNamespaces"`
+	Namespaces    []string            `json:"namespaces,omitempty"`
+	Projects      map[string][]string `json:"projects,omitempty"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

vendor/kmodules.xyz/resource-metadata/crds/identity.k8s.appscode.com_selfsubjectnamespaceaccessreviews.yaml

@@ -96,6 +96,8 @@ spec:
             description: Status is filled in by the server and indicates whether the
               request is allowed or not
             properties:
+              allNamespaces:
+                type: boolean
               namespaces:
                 items:
                   type: string
@@ -106,6 +108,8 @@ spec:
                     type: string
                   type: array
                 type: object
+            required:
+            - allNamespaces
             type: object
         required:
         - spec

vendor/kmodules.xyz/resource-metadata/hub/resourceeditors/catalog.appscode.com/v1alpha1/clickhousebindings.yaml

@@ -15,3 +15,12 @@ spec:
     name: clickhousebindings
     scope: Namespaced
     version: v1alpha1
+  ui:
+    editor:
+      name: catalogappscodecom-clickhousebinding-editor
+      sourceRef:
+        apiGroup: source.toolkit.fluxcd.io
+        kind: HelmRepository
+        name: appscode-charts-oci
+      version: v0.5.0
+    enforceQuota: false

vendor/modules.txt

@@ -2011,7 +2011,7 @@ kmodules.xyz/monitoring-agent-api/client
 ## explicit; go 1.22.0
 kmodules.xyz/offshoot-api/api/v1
 kmodules.xyz/offshoot-api/api/v2
-# kmodules.xyz/resource-metadata v0.18.13-0.20240908185540-fa8ef486973e
+# kmodules.xyz/resource-metadata v0.18.13-0.20240911040707-0451a5c4bbeb
 ## explicit; go 1.22.1
 kmodules.xyz/resource-metadata/apis/core/install
 kmodules.xyz/resource-metadata/apis/core/v1alpha1