fix: properly work if listing ns is denied (#717)

[adietish]

fixes #717

Steps:

1. ASSERT: use minikube cluster
2. ASSERT: have a file deployment.yml with the following content

apiVersion: apps/v1
kind: Deployment
metadata:
  name: sise-deploy
  labels:
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sise
  template:
    metadata:
      labels:
        app: sise
    spec:
      containers:
      - name: sise
        image: quay.io/openshiftlabs/simpleservice:0.5.0
        ports:
        - containerPort: 9876
        env:
        - name: SIMPLE_SERVICE_VERSION
          value: "0.9"

3. EXEC: kubectl apply -f deployment.yml
4. ASSERT: a pod sise-deploy-XXXX was created (kubectl get pod)
5. EXEC: apply the following RBAC rules on minikube

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: can-read-pods
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "watch", "list"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
  namespace: default
subjects:
  - kind: User
    name: user1
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: can-read-pods
  apiGroup: rbac.authorization.k8s.io

6. EXEC: create a new user & context in kube config

openssl req -new -key user1.key -out user1.csr -subj "/CN=user1/O=group1"
openssl x509 -req -in user1.csr -CA ~/.minikube/ca.crt -CAkey ~/.minikube/ca.key -CAcreateserial -out user1.crt -days 500
kubectl config set-credentials user1 --client-certificate=user1.crt --client-key=user1.key
kubectl config set-context user1-context --cluster=minikube --user=user1

7. EXEC: kubectl config use-context user1-context
8. EXEC: launch plugin
9. ASSERT: no current namespace is set ([user1-context] > Namespaces > current: <none>)
10. ASSERT: listing namespaces is forbidden ([user1-context] > Namespaces > child-node: Forbidden!)
11. ASSERT: no pods are listed ([user1-context] > Workloads > Pods: children are empty)
12. EXEC: use Set Current Namespace in context menu to Namespaces, provide default in the upcoming dialog and confirm with the Set button

Result:
current namespace is now default ([user1-context] > Namespaces > current: default), Pod "sise-deploy-XXXX" is listed ([user1-context] > Workloads > Pods > sise-deploy-XXXX)

Screen.Recording.2024-03-18.at.11.32.31.mov

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[adietish]

@datho7561 this is to allow intellij-kubernetes to work properly if you have no current namespace in your config and your cluster wont allow you to list all namespaces. Sorry for the tedious setup required to replicate this. Thanks for testing it :)

[datho7561]

Works great for me!

[adietish]

@datho7561 thanks a lot for testing it :)