Repository navigation
[dashboard] fix listing namespaces as unprivileged user - #1456
Conversation
Signed-off-by: Andrei Kvapil <[email protected]>
WalkthroughAdds a patch-application step to the Dockerfile build for the openapi-ui-k8s-bff image. Introduces a patch changing formPrepare behavior: filters out host and content-length headers and switches the namespaces fetch from /api/v1/namespaces to /apis/core.cozystack.io/v1alpha1/tenantnamespaces. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor U as UI Client
participant B as BFF (formPrepare)
participant K as K8s API
U->>B: POST /forms/prepare (request)
note right of B: Filter headers<br/>- remove host<br/>- remove content-length
B->>K: GET /apis/core.cozystack.io/v1alpha1/tenantnamespaces
K-->>B: 200 OK (tenant namespaces JSON)
B-->>U: 200 OK (prepared form data)
alt Error from K8s API
K-->>B: 4xx/5xx
B-->>U: Error response (preserves existing handling)
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20–30 minutes Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello Andrei Kvapil (@kvaps), I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request resolves an issue preventing unprivileged users from listing namespaces within the dashboard. It achieves this by implementing a new patching system within the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request addresses an issue where unprivileged users cannot list namespaces in the dashboard. The fix involves switching from listing all Kubernetes namespaces to querying a new custom resource, tenantnamespaces, for which all authenticated users have read permissions. The changes include patching the openapi-ui-k8s-bff service to use this new endpoint. My review found the core logic of the fix to be sound. I have one suggestion to improve the robustness of the Docker build process to prevent potential failures in the future.
| RUN wget -O- https://github.com/PRO-Robotech/openapi-ui-k8s-bff/archive/${COMMIT_REF}.tar.gz | tar xzf - --strip-components=1 | ||
|
|
||
| COPY patches /patches | ||
| RUN git apply /patches/*.diff |
There was a problem hiding this comment.
The command git apply /patches/*.diff can fail if there are no .diff files in the /patches directory because the shell glob *.diff would not expand, passing the literal string to git apply and causing the build to fail. To make the build process more robust for future maintenance (e.g., when all patches are removed), it's better to use a command that handles the absence of patch files gracefully.
RUN ls /patches/*.diff >/dev/null 2>&1 && git apply /patches/*.diff || :
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
packages/system/dashboard/images/openapi-ui-k8s-bff/Dockerfile(1 hunks)packages/system/dashboard/images/openapi-ui-k8s-bff/patches/namespaces.diff(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build
🔇 Additional comments (1)
packages/system/dashboard/images/openapi-ui-k8s-bff/patches/namespaces.diff (1)
7-19: Validate TenantNamespace payload expectationsSwitching to
tenantnamespacesmeans we’re now delivering a custom resource while still typing it asTBuiltinResources. Please double-check that the downstream logic only relies on fields that theTenantNamespaceobjects actually expose (e.g.,metadata.name) so we don’t hit runtime surprises in the form pipeline.
| COPY patches /patches | ||
| RUN git apply /patches/*.diff |
There was a problem hiding this comment.
Initialize a git repo before applying patches
Right after untarring the source we’re in a plain directory without .git. git apply will fail with “not a git repository” here, so the current Docker build breaks. Please initialize (and optionally clean up) a repo before applying the patches.
Apply this diff:
COPY patches /patches
-RUN git apply /patches/*.diff
+RUN git init \
+ && git apply /patches/*.diff \
+ && rm -rf .git🤖 Prompt for AI Agents
In packages/system/dashboard/images/openapi-ui-k8s-bff/Dockerfile around lines
10 to 11, the Docker build runs git apply against a directory without a .git
repo which causes “not a git repository” errors; initialize a repo before
applying patches by running git init, add the files (git add -A) and create an
initial commit (git commit -m "init") so git apply can succeed, then apply the
patches (git apply /patches/*.diff) and optionally remove or clean up the .git
directory (rm -rf .git) afterwards if you don’t want the repo left in the image.
1 participant
Signed-off-by: Andrei Kvapil [email protected]
What this PR does
Release note
Summary by CodeRabbit
Improvements
Bug Fixes
Chores