Add sync.RWMutex to protect loggedAllowedNS against concurrent writes
@@ -108,6 +108,7 @@ type Cluster struct {
allowedNamespaces map[string]struct{}
loggedAllowedNS map[string]bool // to keep track of whether we've logged a problem with seeing an allowed namespace
+ loggedAllowedNSLock sync.RWMutex
imageIncluder cluster.Includer
resourceExcludeList []string
@@ -317,13 +318,13 @@ func (c *Cluster) getAllowedAndExistingNamespaces(ctx context.Context) ([]string
ns, err := c.client.CoreV1().Namespaces().Get(name, meta_v1.GetOptions{})
switch {
case err == nil:
- c.loggedAllowedNS[name] = false // reset, so if the namespace goes away we'll log it again
+ c.updateLoggedAllowedNS(name, false) // reset, so if the namespace goes away we'll log it again
nsList = append(nsList, ns.Name)
case apierrors.IsUnauthorized(err) || apierrors.IsForbidden(err) || apierrors.IsNotFound(err):
- if !c.loggedAllowedNS[name] {
+ if !c.getLoggedAllowedNS(name) {
c.logger.Log("warning", "cannot access allowed namespace",
"namespace", name, "err", err)
- c.loggedAllowedNS[name] = true
+ c.updateLoggedAllowedNS(name, true)
}
default:
return nil, err
@@ -338,6 +339,20 @@ func (c *Cluster) getAllowedAndExistingNamespaces(ctx context.Context) ([]string
return []string{meta_v1.NamespaceAll}, nil
}
+func (c *Cluster) updateLoggedAllowedNS(key string, value bool) {
+ c.loggedAllowedNSLock.Lock()
+ defer c.loggedAllowedNSLock.Unlock()
+
+ c.loggedAllowedNS[key] = value
+}
+
+func (c *Cluster) getLoggedAllowedNS(key string) bool {
+ c.loggedAllowedNSLock.RLock()
+ defer c.loggedAllowedNSLock.RUnlock()
+
+ return c.loggedAllowedNS[key]
+}
+
func (c *Cluster) IsAllowedResource(id resource.ID) bool {
if len(c.allowedNamespaces) == 0 {
// All resources are allowed when all namespaces are allowed
