Adds support for restricted namespaces

backend/cmd/server/config.go

@@ -23,10 +23,10 @@ import (
 )
 
 type Config struct {
-	AuthMode   ginapp.AuthMode `mapstructure:"auth-mode" validate:"oneof=cluster token local"`
-	KubeConfig string          `mapstructure:"kube-config"`
-	BasePath   string          `mapstructure:"base-path"`
-	Namespace  string
+	AuthMode          ginapp.AuthMode `mapstructure:"auth-mode" validate:"oneof=cluster token local"`
+	KubeConfig        string          `mapstructure:"kube-config"`
+	BasePath          string          `mapstructure:"base-path"`
+	AllowedNamespaces []string        `mapstructure:"allowed-namespaces"`
 
 	// session options
 	Session struct {
@@ -110,7 +110,7 @@ func DefaultConfig() Config {
 	cfg.AuthMode = appDefault.AuthMode
 	cfg.KubeConfig = filepath.Join(home, ".kube", "config")
 	cfg.BasePath = appDefault.BasePath
-	cfg.Namespace = appDefault.Namespace
+	cfg.AllowedNamespaces = appDefault.AllowedNamespaces
 
 	cfg.Session.Secret = appDefault.Session.Secret
 	cfg.Session.Cookie.Name = appDefault.Session.Cookie.Name

backend/cmd/server/main.go

@@ -192,7 +192,7 @@ func main() {
 			appCfg.AuthMode = ginapp.AuthMode(cfg.AuthMode)
 			appCfg.KubeConfig = cfg.KubeConfig
 			appCfg.BasePath = cfg.BasePath
-			appCfg.Namespace = cfg.Namespace
+			appCfg.AllowedNamespaces = cfg.AllowedNamespaces
 			appCfg.AccessLog.Enabled = cfg.Logging.AccessLog.Enabled
 			appCfg.AccessLog.HideHealthChecks = cfg.Logging.AccessLog.HideHealthChecks
 			appCfg.Session.Secret = cfg.Session.Secret

backend/go.mod

@@ -21,9 +21,10 @@ require (
 	github.com/spf13/viper v1.18.2
 	github.com/stretchr/testify v1.9.0
 	github.com/vektah/gqlparser/v2 v2.5.11
-	k8s.io/api v0.29.3
-	k8s.io/apimachinery v0.29.3
-	k8s.io/client-go v0.29.3
+	k8s.io/api v0.30.0
+	k8s.io/apimachinery v0.30.0
+	k8s.io/apiserver v0.30.0
+	k8s.io/client-go v0.30.0
 	k8s.io/utils v0.0.0-20240310230437-4693a0247e57
 )
 

backend/graph/errors.go

@@ -22,6 +22,7 @@ import (
 // custom errors
 var (
 	ErrUnauthenticated     = NewError("KUBETAIL_UNAUTHENTICATED", "Authentication required")
+	ErrForbidden           = NewError("KUBETAIL_FORBIDDEN", "Access forbidden")
 	ErrWatchError          = NewError("KUBETAIL_WATCH_ERROR", "Watch error")
 	ErrInternalServerError = NewError("INTERNAL_SERVER_ERROR", "Internal server error")
 )