Merge pull request #254 from wanjunlei/release-2.5

optimize queries
kubesphere · Mar 21, 2024 · 29ddb6c · 29ddb6c
2 parents 055bf5a + 45c8849
commit 29ddb6c
Show file tree

Hide file tree

Showing 3 changed files with 106 additions and 177 deletions.
diff --git a/sidecar/kubesphere/4.0.0/backend.go b/sidecar/kubesphere/4.0.0/backend.go
@@ -89,26 +89,29 @@ func (b *Backend) reload() {
 		klog.Errorf("list namespaces error, %s", err.Error())
 	}
 
+	var items []iamv1beta1.SubjectAccessReview
+
 	m := make(map[string]map[string]string)
 	for _, namespace := range namespaces {
 		for _, user := range users {
-			allow, err := b.canAccess(user, namespace)
-			if err != nil {
-				klog.Errorf("get access view for user %s, namespace %s error, %s", err.Error())
-				return
-			}
-
-			if allow {
-				array, ok := m[namespace]
-				if !ok {
-					array = make(map[string]string)
-				}
-				array[user] = ""
-				m[namespace] = array
+			sar := iamv1beta1.SubjectAccessReview{
+				Spec: iamv1beta1.SubjectAccessReviewSpec{
+					ResourceAttributes: &iamv1beta1.ResourceAttributes{
+						Namespace: namespace,
+						Verb:      "get",
+						Group:     "notification.kubesphere.io",
+						Version:   "v2beta2",
+						Resource:  "receivenotification",
+					},
+					NonResourceAttributes: nil,
+					User:                  user,       // "X-Remote-User" request header
+					Groups:                []string{}, // "X-Remote-Group" request header
+				},
 			}
+			items = append(items, sar)
 		}
 	}
-
+	b.batchRequest(items, m)
 	b.tenants = m
 }
 
@@ -175,3 +178,40 @@ func (b *Backend) canAccess(user, namespace string) (bool, error) {
 
 	return subjectAccessReview.Status.Allowed, nil
 }
+
+func (b *Backend) batchRequest(subjectAccessReviews []iamv1beta1.SubjectAccessReview, m map[string]map[string]string) {
+
+	batchSize := 500
+	for i := 0; i < len(subjectAccessReviews); i += batchSize {
+		items := subjectAccessReviews[i:minimum(i+batchSize, len(subjectAccessReviews))]
+		list := &iamv1beta1.SubjectAccessReviewList{
+			Items: items,
+		}
+		if err := b.ksClient.Post().AbsPath("/kapis/iam.kubesphere.io/v1beta1/subjectaccessreviews").
+			Body(list).
+			Do(context.Background()).
+			Into(list); err != nil {
+			klog.Errorf("get access view error: %s", err.Error())
+			return
+		}
+		for _, item := range items {
+			if item.Status.Allowed {
+				ns := item.Spec.ResourceAttributes.Namespace
+				user := item.Spec.User
+				array, ok := m[ns]
+				if !ok {
+					array = make(map[string]string)
+				}
+				array[user] = ""
+				m[ns] = array
+			}
+		}
+	}
+}
+
+func minimum(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
diff --git a/sidecar/kubesphere/4.0.0/go.mod b/sidecar/kubesphere/4.0.0/go.mod
@@ -8,12 +8,12 @@ go 1.20
 
 require (
 	github.com/emicklei/go-restful/v3 v3.11.0
-	github.com/spf13/cobra v1.6.1
+	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
-	k8s.io/api v0.26.1
+	k8s.io/api v0.28.2
 	k8s.io/klog v1.0.0
 	kubesphere.io/api v0.0.0
-	kubesphere.io/client-go v0.3.2-0.20230919075122-75a5b5faff8a
+	kubesphere.io/client-go v0.3.2-0.20231222062608-a76cf3626c7e
 )
 
 require (
@@ -23,36 +23,36 @@ require (
 	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/gnostic v0.6.9 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	golang.org/x/net v0.17.0 // indirect
-	golang.org/x/oauth2 v0.4.0 // indirect
+	golang.org/x/oauth2 v0.12.0 // indirect
 	golang.org/x/text v0.13.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apimachinery v0.26.1 // indirect
-	k8s.io/client-go v0.26.1 // indirect
-	k8s.io/klog/v2 v2.90.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20230224204730-66828de6f33b // indirect
-	k8s.io/utils v0.0.0-20230202215443-34013725500c // indirect
-	sigs.k8s.io/controller-runtime v0.14.4 // indirect
+	k8s.io/apimachinery v0.28.2 // indirect
+	k8s.io/client-go v0.28.2 // indirect
+	k8s.io/klog/v2 v2.100.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
+	k8s.io/utils v0.0.0-20230505201702-9f6742963106 // indirect
+	sigs.k8s.io/controller-runtime v0.16.0 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.3.0 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
 
 replace (
 	github.com/emicklei/go-restful v2.9.6+incompatible => github.com/emicklei/go-restful/v3 v3.8.0
-	kubesphere.io/api => kubesphere.io/api v0.0.0-20230919074900-8dfcb0026bba
+	kubesphere.io/api => kubesphere.io/api v0.0.0-20240307025220-d785e90d0c05
 )