Support clusters where RBAC allows list but not watch

[magnus-bb]

Problem

On a client's cluster, my account can list pods but not watch them:

$ kubectl auth can-i list pods -A
yes
$ kubectl auth can-i watch pods -A
no

sofka doesn't work there. Right after opening, the status bar shows this and keeps retrying:

watch failed; retrying: watch stream failed: ApiError: pods is forbidden: User "oidc:<user>" cannot watch resource "pods" in API group "" at the cluster scope: Forbidden ...

The same goes for all other resources. The list of resources is just empty.

How I handle it now

I use k9s for this cluster from necessity, though I prefer sofka. It works with the same credentials, though it feels less responsive than on clusters where I can watch, presumably because it falls back to periodic list calls.

How it would help

If sofka fell back to listing on an interval when a watch is refused, I could use it on this cluster instead of switching to k9s. An interval like k9s's default refresh rate of 2 seconds would feel close to the live updates I get on other clusters.

Would you want sofka to support this setup? I can test a fix against this cluster.

[nklmilojevic]

Thanks for the detailed report, the can-i output made this easy to pin down!

Yes, sofka will support this. It's actually worse than just "no watch": sofka starts every view with a streaming list, which is itself a WATCH request. It only falls back to a plain LIST when the API server says it doesn't support streaming lists, not on a 403, so on your cluster no LIST ever runs - hence the empty table and the endless retry.

1. Fall back to listing when watch is forbidden - yes. A 403 on the watch switches that view to listing on a fixed 2 second interval. A 403 on the list itself stays an error, since then you really can't see the resource.
2. Bounded API load - only the view you're looking at polls, and lists ask for resourceVersion=0 so the API server answers from its cache instead of hitting etcd every 2 seconds.
3. Make it visible - the header shows that the view is polled, with text like polling 2s (watch forbidden), so you know updates can lag. sofka --check reports it too.

No config option for the interval - 2 seconds is close enough to live and one behaviour is simpler to reason about.

I'll create an issue for this and link it here.

[nklmilojevic]

Created #979 for this. Closing this one, follow along there :)

[magnus-bb]

Awesome! Looking forward to testing it, so I can leave k9s in the dust 😊

[nklmilojevic]

It is already out in 0.33.0, let me know how it works :)

[magnus-bb]

Works excellently. UI shows the 'polling' indicator and explicitly says that 'watch' is forbidden, so it falls back to 2s polling. I cannot provoke errors on any lists from my initial testing.