GeezerVison

Summary by CodeRabbit

• Performance

  • Effective access-scope checks reuse a shared cluster and namespace inventory for up to five seconds, reducing repeated data reads.
  • Cluster and namespace label lookups benefit from database indexes.

• Access Control

  • Changes to cluster or namespace names and labels may take up to five seconds, plus refresh time, to affect new access checks. Role permissions and scope rules are not cached.

• Reliability

  • Reads across application instances now reflect cluster and namespace inserts, updates, and deletions.
  • If refreshing an expired inventory fails, access checks receive the error rather than using stale data.

SAC cluster and namespace inventory reads now accept contexts and walk their stores. The built-in scope checker uses a shared five-second inventory cache. SAC-specific cached-store APIs are removed, and cluster and namespace labels receive GIN indexes.

Changes: SAC scope inventory

Layer / File(s)	Summary
Remove SAC-specific cached store APIs central/cluster/store/cluster/*, central/namespace/datastore/internal/store/*, central/namespace/datastore/internal/store/postgres/*, central/namespace/datastore/internal/store/store.go, pkg/search/postgres/*, tools/generate-helpers/pg-table-bindings/*, proto/TAGS.md	Cluster and namespace stores use generic PostgreSQL stores without the SAC-specific cache API. The generator flag and generated method are removed. SQL integration tests check whether reads observe writes from a second store instance.
Build inventories with context-aware reads central/cluster/datastore/*, central/namespace/datastore/*	Cluster and namespace SAC inventory methods accept contexts and walk their stores with all-access context. They return inventory data and propagate walk errors. Callers, mocks, and tests pass contexts.
Cache inventory for scope authorization central/sac/authorizer/*, pkg/postgres/schema/{clusters,namespaces}.go, proto/storage/{cluster,namespace_metadata}.proto	The built-in scope checker gets both inventories through a five-second cache. Tests cover concurrent loads, refresh failures, cancellation, and label-based access revocation. A SQL integration benchmark measures authorization and inventory loads. Cluster and namespace labels receive GIN indexes. The README describes cache behavior.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant BuiltInScopeChecker
  participant ScopeInventory
  participant ClusterDataStore
  participant NamespaceDataStore
  BuiltInScopeChecker->>ScopeInventory: get(ctx)
  ScopeInventory->>ClusterDataStore: GetClustersForSAC(ctx)
  ClusterDataStore-->>ScopeInventory: clusters or error
  ScopeInventory->>NamespaceDataStore: GetNamespacesForSAC(ctx)
  NamespaceDataStore-->>ScopeInventory: namespaces or error
  ScopeInventory-->>BuiltInScopeChecker: inventory or error

Loading

Suggested reviewers: clickboo

Merge Risk: Moderate · previous review a2395

Cancellation of one inventory refresh can cause other active requests to fail. This should be addressed before merging.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the main changes: adding label indexes and removing cluster and namespace caches.
Description check		The description follows the required template and explains the scope, user-facing documentation status, testing, validation results, benchmark data, and known limitations. The production-readiness and…
Docstring Coverage		Docstring coverage is inconclusive: files from earlier reviews still need to be rechecked within the check's analysis limits. Not blocking.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description follows the required template and explains the scope, user-facing documentation status, testing, validation results, benchmark data, and known limitations. The production-readiness and CI-inspection checkboxes remain unchecked, but the description is otherwise substantially complete.

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

@@            Coverage Diff             @@
##           master   #23366      +/-   ##
==========================================
- Coverage   52.65%   52.62%   -0.03%     
==========================================
  Files        2830     2831       +1     
  Lines      177659   177702      +43     
==========================================
- Hits        93548    93518      -30     
- Misses      75932    75982      +50     
- Partials     8179     8202      +23     

Flags with carried forward coverage won't be shown. Click here to find out more.

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.