Conversation
Port SelfSubjectRulesReview short-circuit, access-cache hardening, eventsDefinitions/CLUSTER_SCOPED_KINDS, and filter-before-inflate SSE from stolostron#6638 so restricted users no longer OOM the console backend. Signed-off-by: Enrique Mingorance Cano <emingora@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Cover access cache, SelfSubjectRulesReview short-circuit, cluster-scoped routing, and filter-before-inflate behavior. Signed-off-by: Enrique Mingorance Cano <emingora@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Ginxo The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
1 participant
ACM-44886: Fix non-admin SSE OOM under large inventory (release-5.0)
https://redhat.atlassian.net/browse/ACM-44886
Summary
Manual backport of the SSE OOM / RBAC fix from ACM-44885 / #6638 to
release-5.0(fast-forwards tobackplane-5.0).listis denied, use SelfSubjectRulesReview per token+namespace instead of O(namespaces) namespaced list + O(N) per-object SSARs.eventsDefinitions.tswithCLUSTER_SCOPED_KINDSderived fromclusterScopedflags (Kevin's agreed design from ACM-39327: Fix non-admin SSE OOM under large inventory (release-2.13) #6648).metato avoid materializing denied resources.Related: #6638, #6648
Test plan
npm test -- --testPathPattern='test/(routes/events(Access|Cache)?|lib/server-side-events)\.test\.ts'in backendnpm run checkin backendMOCK_CLUSTERS=1000, kubeadmin vs restricted/noneon Inventory; confirm backend RSS/CPU stay boundednonecompletes SSE load without backend hangMade with Cursor