K8S - cannot list resource "nodes" in API group "" at the cluster scope about xpipe

[crschnick]

Oh, I have not considered the case with limited permissions. I think I can work around this without listing nodes in the next update.

But you have any other permissions usually required that you need to query pods, enter shells into containers, etc. or is there any other permissions I also need to think twice about?

[philippe-granet]

I have this for production namespace (can't enter shells for example):

PS C:\> kubectl auth can-i --list  --namespace <namespace>
Resources                                       Non-Resource URLs   Resource Names   Verbs
poddisruptionbudgets.policy                     []                  []               [get list watch]
configmaps                                      []                  []               [list get watch]
endpoints                                       []                  []               [list get watch]
events                                          []                  []               [list get watch]
namespaces                                      []                  []               [list get watch]
persistentvolumeclaims                          []                  []               [list get watch]
pods/attach                                     []                  []               [list get watch]
pods/exec                                       []                  []               [list get watch]
pods/log                                        []                  []               [list get watch]
pods                                            []                  []               [list get watch]
podtemplates                                    []                  []               [list get watch]
resourcequotas                                  []                  []               [list get watch]
serviceaccounts                                 []                  []               [list get watch]
services                                        []                  []               [list get watch]
deployments.apps/rollback                       []                  []               [list get watch]
deployments.apps/scale                          []                  []               [list get watch]
deployments.apps                                []                  []               [list get watch]
replicasets.apps/scale                          []                  []               [list get watch]
replicasets.apps                                []                  []               [list get watch]
statefulsets.apps/scale                         []                  []               [list get watch]
statefulsets.apps                               []                  []               [list get watch]
horizontalpodautoscalers.autoscaling            []                  []               [list get watch]
cronjobs.batch                                  []                  []               [list get watch]
jobs.batch/status                               []                  []               [list get watch]
jobs.batch                                      []                  []               [list get watch]
replicationcontrollers                          []                  []               [list]
daemonsets.apps                                 []                  []               [list]

[crschnick]

So I fixed the issue when nodes could not be listed and that will be released in the next update.

But it's going to be complicated when you don't have permission to enter shells as that kinda removes most of the functionality as you can't open a terminal session or file browser session then. Assuming from the permissions you posted you also can't start, stop, control pods, I don't think there's anything useful that you can do in xpipe with these limited permissions other than listing and checking the status for that cluster.

[philippe-granet]

Thanks for your fix!
I cant' list nodes on all environements. But on environments other than production, I have permission to enter shells.

[crschnick]

This is now released. Let me know whether everything works for you now

[philippe-granet]

@crschnick
I have now this error: cannot list resource "pods" in API group "" at the cluster scope
I can list pod at the namespace scope but not at the cluster scope

[crschnick]

I guess this error is now more expected, XPipe uses contexts instead of namespaces to access clusters so I think that you would have to list permissions for the context not the namespace. I probably missed that you listed namespace permissions