Repository navigation
ACM-44887: fix non-admin SSE OOM on release-2.17 - #6838
Conversation
Port SelfSubjectRulesReview short-circuit, access-cache hardening, eventsDefinitions/CLUSTER_SCOPED_KINDS, and filter-before-inflate SSE from stolostron#6638 so restricted users no longer OOM the console backend. Signed-off-by: Enrique Mingorance Cano <emingora@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Cover access cache, SelfSubjectRulesReview short-circuit, cluster-scoped routing, and filter-before-inflate behavior. Signed-off-by: Enrique Mingorance Cano <emingora@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: stolostron/console/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
| // If a client hasn't finished receiving a broadcast in PURGE_CLIENT_TIMEOUT | ||
| // assume the browser has been refreshed or closed | ||
| const PURGE_CLIENT_TIMEOUT = 4 * 60 * 60 * 1000 | ||
| const PURGE_CLIENT_TIMEOUT = 30 * 60 * 1000 |
There was a problem hiding this comment.
👍 this has been aligned with >2.17 versions
…s -> definitions Signed-off-by: Enrique Mingorance Cano <emingora@redhat.com>
| }> | ||
| } | ||
|
|
||
| export type KindGetAccess = |
There was a problem hiding this comment.
just formatting changes here
|
|
||
| import type { IWatchOptions } from '../resources/watch-options' | ||
|
|
||
| export const definitions: IWatchOptions[] = [ |
There was a problem hiding this comment.
definitions according to
console/backend/src/routes/events.ts
Line 244 in e6561b2
Release-2.17 watch definitions omit clusterScoped flags, so CLUSTER_SCOPED_KINDS is empty and SSRR grants are trusted without mandatory SSAR confirmation for ManagedCluster and StorageClass. Signed-off-by: Enrique Mingorance Cano <emingora@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Good catch, thank you! I was focused on maintaining consistency with the target branch and overlooked that detail.
Signed-off-by: Enrique Mingorance Cano <emingora@redhat.com>
|
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Ginxo, KevinFCormier The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
be591c5
into
stolostron:release-2.17
console-mce-console* pods crashing / OOMKilled [release-2.17]
https://redhat.atlassian.net/browse/ACM-44887
Summary
release-2.17(ACM-39327 / ACM-44887).eventsAccess,eventsCache, andeventsDefinitionswithCLUSTER_SCOPED_KINDS; cluster-scoped kinds match the 2.17 watch list (no ClusterExtension).Test plan
npm run test:backendnpm run check:backendMade with Cursor