GeezerVison

Summary by CodeRabbit

• Bug Fixes
  • Cluster and namespace updates are no longer held in a separate five-second authorization snapshot, so scope checks use the latest inventory available to the system.

SAC scope construction now reads clusters and namespaces through datastore cache accessors. The five-second authorizer inventory cache was removed. Cluster and namespace stores now use cached generic stores, and their label GIN-index declarations were removed.

Changes: SAC inventory retrieval

Layer / File(s)	Summary
SAC cache accessor and generator support pkg/search/postgres/*, tools/generate-helpers/pg-table-bindings/*, proto/TAGS.md, central/cluster/store/cluster/postgres/gen.go, central/namespace/datastore/internal/store/postgres/gen.go	The generic store interface adds GetAllFromCacheForSAC. Cached stores return cached objects in a new slice without cloning them; uncached stores panic when this method is called. The binding generator adds --for-sac, which exposes the method only with --cached-store. Tests and generator documentation cover these changes.
Enable cached cluster and namespace stores central/cluster/store/cluster/*, central/namespace/datastore/internal/store/*, pkg/postgres/schema/*, proto/storage/*	Cluster and namespace PostgreSQL stores now use cached generic stores and expose the SAC accessor. Both stores record cache-operation duration. The label GIN-index declarations and cross-store consistency tests were removed.
Read SAC scopes through datastores central/cluster/datastore/*, central/namespace/datastore/*	The cluster and namespace SAC datastore methods no longer take a context. They convert cached store objects to effective access scopes. Their mocks and tests were updated. Namespace tests also change the expected results for empty-ID operations.
Build scope checkers from datastore results central/sac/authorizer/*	NewBuiltInScopeChecker now retrieves clusters and namespaces separately from their datastores and passes them to the scope checker. The separate five-second inventory cache, its tests and benchmark, and its README were removed.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Other

Sequence Diagram(s)

sequenceDiagram
  participant NewBuiltInScopeChecker
  participant ClusterDataStore
  participant NamespaceDataStore
  participant GlobalScopeChecker
  NewBuiltInScopeChecker->>ClusterDataStore: GetClustersForSAC()
  NewBuiltInScopeChecker->>NamespaceDataStore: GetNamespacesForSAC()
  NewBuiltInScopeChecker->>GlobalScopeChecker: newGlobalScopeCheckerCore(clusters, namespaces, roles, trace)

Loading

Suggested reviewers: ajheflin, dashrews78

Merge Risk: Moderate · up to 54b6f

If the initial cluster or namespace cache load fails, the first authorization check can panic instead of returning an error. Handle the fallback or fail startup before merging. The PR is also marked do-not-merge.

Pre-merge checks: 3 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description contains only the placeholder text "Just for testing". It does not follow the required template. It lacks the explanation of changes, the user-facing documentation checklist, the testi…	Replace the placeholder with a detailed explanation of the change. Explain why the commit 9f3b401 is reverted and what behavior changes. Complete the template sections: the CHANGELOG.md and documentation PR …

Passed checks: 3 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title says the PR reverts the earlier removal of the cluster and namespace caches. The raw summary matches that: it restores cached stores with GetAllFromCacheForSAC, reintroduces the cached-store…

Full details: Title check

Explanation

The title says the PR reverts the earlier removal of the cluster and namespace caches. The raw summary matches that: it restores cached stores with GetAllFromCacheForSAC, reintroduces the cached-store generator flags, and removes the label GIN indexes. The title names the main change, but it uses the internal term 'Jv' and the words 'DON'T REVIEW', which add noise and do not describe the change for a future reader. The PR objectives confirm the revert of commit 9f3b401, so the title is related to the changeset and is not off-topic.

Full details: Description check

Explanation

The description contains only the placeholder text "Just for testing". It does not follow the required template. It lacks the explanation of changes, the user-facing documentation checklist, the testing and quality checklist, and the validation section. The description is largely incomplete, so the check fails.

Resolution

Replace the placeholder with a detailed explanation of the change. Explain why the commit 9f3b401 is reverted and what behavior changes. Complete the template sections: the CHANGELOG.md and documentation PR status, the production-readiness and CI checks, the automated testing checklist, and the 'How I validated my change' section. Explain how the revert was validated, including the SQL integration tests and benchmark removals.

@@            Coverage Diff             @@
##           master   #24022      +/-   ##
==========================================
- Coverage   52.69%   52.67%   -0.03%     
==========================================
  Files        2815     2814       -1     
  Lines      177457   177382      -75     
==========================================
- Hits        93512    93428      -84     
+ Misses      75770    75749      -21     
- Partials     8175     8205      +30     

Flags with carried forward coverage won't be shown. Click here to find out more.

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.