From b0480cbbc637a46ac8e0e438458b1d2e360b8681 Mon Sep 17 00:00:00 2001 From: pashakostohrys Date: Wed, 12 Jul 2023 18:19:38 +0300 Subject: [PATCH] fix: not need send application if it is not under enabled namespaces --- server/application/application.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/server/application/application.go b/server/application/application.go index 0a82be5f2f35c..87736418795b3 100644 --- a/server/application/application.go +++ b/server/application/application.go @@ -50,7 +50,6 @@ import ( "github.com/argoproj/argo-cd/v2/util/db" "github.com/argoproj/argo-cd/v2/util/env" "github.com/argoproj/argo-cd/v2/util/git" - "github.com/argoproj/argo-cd/v2/util/glob" ioutil "github.com/argoproj/argo-cd/v2/util/io" "github.com/argoproj/argo-cd/v2/util/lua" "github.com/argoproj/argo-cd/v2/util/manifeststream" @@ -225,7 +224,7 @@ func (s *Server) List(ctx context.Context, q *application.ApplicationQuery) (*ap for _, a := range filteredApps { // Skip any application that is neither in the control plane's namespace // nor in the list of enabled namespaces. - if a.Namespace != s.ns && !glob.MatchStringInList(s.enabledNamespaces, a.Namespace, false) { + if s.isNamespaceEnabled(a.Namespace) { continue } if s.enf.Enforce(ctx.Value("claims"), rbacpolicy.ResourceApplications, rbacpolicy.ActionGet, a.RBACName(s.ns)) { @@ -1024,6 +1023,10 @@ func (s *Server) Watch(q *application.ApplicationQuery, ws application.Applicati return } + if s.isNamespaceEnabled(a.Namespace) { + return + } + if !s.enf.Enforce(claims, rbacpolicy.ResourceApplications, rbacpolicy.ActionGet, a.RBACName(s.ns)) { // do not emit apps user does not have accessing return