Kubeapps: Set default namespace for users/groups

[rarick]

Description:

Steps to reproduce the issue:

1. Sign in as user with edit capabilities only on namespace NAMESPACE

Describe the results you received:

• Upon sign in, user is redirected to kubeapps.example.com/#/ns/_all/apps
• The user then has to change to namespace NAMESPACE every time

Describe the results you expected:

Ideally, the user would automatically be redirected to NAMESPACE since it's the only namespace where work can be done by the user. Defaults could potentially be done by configuring RBAC groups / users to certain namespaces. Potentially automatically, or maybe by specification in values.yml.

At the least the server cache which namespace was last used so it isn't required to select the namespace every time.

Additional information you deem important (e.g. issue happens only occasionally):

This discussion seems to be related to #1162

[absoludity]

Agree totally. So the larger picture here is that users who only have edit capabilities only on a namespace NAMESPACE cannot even list namespaces to populate the drop-down. We've enabled an option in Kubeapps (allowNamespaceDiscovery which I assume you're using - it's now defaulting to true) so that we could in fact, once the list of namespaces are fetched, default to the first one upon first login (and store state for the last used namespace for subsequent logins).

This way we could leave the "All Namespaces" option present, so people can select it, know it's an option and know the RBAC they require to use it (as argued in #1162 in response to my request to remove it if people can't use it), but it wouldn't be the default. Or we could remove it for those users.

[andresmgot]

In addition to that, I would store the latest namespace used in the browser, that way they can resume what they were doing when re-login for example.

[rarick]

That sounds great, look forward to seeing that!

[absoludity]

Also (more related feedback from a user), if the original URL from before login was for a particular namespace, we should not override that with the namespace of a service account token. In fact, given that we're trying to move people to use OIDC/auth proxy, we could even disable/remove the feature which uses the namespace of the service account token.
EDIT: User confirmed that it doesn't overwrite, so ignore this comment.

[andresmgot]

After #2018, this has been covered. Now the latest namespace used is stored in the browser so the last session would be resumed once re-opening Kubeapps. Let us know if you still think there is something we should cover!

[kvaps]

@andresmgot can default namespace be set per user?

[andresmgot]

Yes, but it's not a configuration setting. A user will only see the namespaces they have access to. If a user has access to more than one namespace, the first one (in alphabetical order) will be selected by default but if they change it, that change will be cached so next time they open kubeapps, that's the namespace that will be selected. More info about the changes included here: https://github.com/kubeapps/kubeapps/issues/2018#issuecomment-704880000

Also note that the changes are in master but they has not been released yet.