Establish Kubernetes permissions with one listing instead of twenty-six probes - #11
Merged
Merged
Conversation
…ix probes The readiness check took 5.4 seconds on Windows, and the settings page waits on it, so Secure Workspaces looked stuck every time it was opened. Measured rather than guessed: the twenty-six `auth can-i` calls account for 3.6 of those seconds. Not the cluster — a single probe is 276ms and the round trips overlap — but creating twenty-six processes. Raising the concurrency confirms it: 8 gives 3595ms, 16 gives 4246ms, 26 gives 3883ms. There is nothing left to parallelise. `auth can-i --list` answers for all of them in one call, measured at 251ms. That listing is a table meant for people, so it is used only to grant. A permission its rules clearly cover is settled; anything else — an unfamiliar row, a wildcard shape this parser does not handle, a call that failed outright — falls through to the same explicit probe as before. A parse that understands less is slower, never wrong, and an admin account's single wildcard rule settles all twenty-six. Two shapes are deliberately not read as grants: a row whose resource column is empty describes a URL path rather than an API resource, and a rule naming specific objects does not grant the verb on the resource in general.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The readiness check took 5.4 seconds on Windows, and the Secure Workspaces settings page waits on it — so the page looked stuck every time it was opened.
Measured rather than guessed. The twenty-six
kubectl auth can-icalls account for 3.6 of those seconds, and the cost is process creation, not the cluster:auth can-i --list, one callRaising the concurrency does not help, which is the evidence that there is nothing left to parallelise — the spawns themselves saturate.
Why parsing a human-readable table is acceptable here
It is used only to grant. A permission the parsed rules clearly cover is settled; anything else falls through to the explicit probe that was always there — an unfamiliar row, a wildcard shape the parser does not handle, or a listing that failed outright. A parse that understands less is slower, never wrong. An admin account's single
*.*rule settles all twenty-six, so the common case makes one call and no probes.Two shapes are deliberately not read as grants:
[/healthz] [] [get]), not an API resource — reading it as one would hand outgeton whatever was asked about;secrets [] [one-secret] [get]) does not grant the verb on the resource in general.Testing
Six tests over real admin output, a namespace-scoped role, and the shapes above, including that an unreadable listing settles nothing. Full suite on Windows: 157 passed, 3 skipped, 0 failed.