kubeapps Use an explicit token to identify kubeapps cluster when required.

Use an explicit token to identify kubeapps cluster when required.

Open absoludity opened this issue 2 years ago • 1 comments

Signed-off-by: Michael Nelson [email protected]

Description of the change

For discussion related to #4564 .

This PR aims to ensure that the context for an available package can always be resolved, even when there is no configured cluster name corresponding to the cluster on which Kubeapps is installed.

We need to test this as I suspect, if installing a package still requires fetching the AppRepository, that it would mean that the user credential must be valid to authenticate with the cluster on which Kubeapps is installed. The user doesn't need any RBAC, only the ability to authenticate, since Kubeapps already includes RBAC to ensure that global repositories are readable by any authenticated user.

Also, if pinniped-proxy is being used, it won't currently handle this scenario (where the new token is used for the cluster on which Kubeapps is installed), but that will be easy to update. I'll add that depending on the discussion here.