From 1cd05873f5aa05c2d9ae01c47aeb7bc735f4304c Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Thu, 29 Jan 2026 23:12:55 +0100
Subject: [PATCH] feat: add skip namespace validation option for RBAC filters

---
 cmd/kor/root.go        |  1 +
 pkg/filters/options.go | 23 +++++++++++++++++------
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/cmd/kor/root.go b/cmd/kor/root.go
index 969a037e..d395f71d 100644
--- a/cmd/kor/root.go
+++ b/cmd/kor/root.go
@@ -133,6 +133,7 @@ func addFilterOptionsFlag(cmd *cobra.Command, opts *filters.Options) {
 	cmd.PersistentFlags().StringSliceVarP(&opts.ExcludeNamespaces, "exclude-namespaces", "e", opts.ExcludeNamespaces, "Namespaces to be excluded, split by commas. Example: --exclude-namespaces ns1,ns2,ns3. If --include-namespaces is set, --exclude-namespaces will be ignored")
 	cmd.PersistentFlags().StringSliceVarP(&opts.IncludeNamespaces, "include-namespaces", "n", opts.IncludeNamespaces, "Namespaces to run on, split by commas. Example: --include-namespaces ns1,ns2,ns3. If set, non-namespaced resources will be ignored")
 	cmd.PersistentFlags().BoolVar(&opts.IgnoreOwnerReferences, "ignore-owner-references", false, "Skip resources that have ownerReferences set (for all resource types)")
+	cmd.PersistentFlags().BoolVar(&opts.SkipNamespaceValidation, "skip-namespace-validation", false, "Skip namespace existence validation (requires --include-namespaces). Use in permission-limited clusters with only Role/RoleBinding")
 }
 
 // shouldSkipKubeInitialization determines if a command should skip kubeconfig initialization.
diff --git a/pkg/filters/options.go b/pkg/filters/options.go
index 557938c8..bf5496b4 100644
--- a/pkg/filters/options.go
+++ b/pkg/filters/options.go
@@ -41,6 +41,9 @@ type Options struct {
 	IncludeNamespaces []string
 	// IgnoreOwnerReferences skips any resource that has ownerReferences set (for all resource types)
 	IgnoreOwnerReferences bool
+	// SkipNamespaceValidation skips validating namespace existence via API calls.
+	// Use this in permission-limited clusters where you only have namespace-scoped RBAC (Role/RoleBinding).
+	SkipNamespaceValidation bool
 
 	namespace []string
 	once      sync.Once
@@ -126,15 +129,23 @@ func (o *Options) Namespaces(clientset kubernetes.Interface) []string {
 			slices.Sort(includeNamespaces)
 			includeNamespaces = slices.Compact(includeNamespaces)
 
-			for _, ns := range includeNamespaces {
-
-				_, err := clientset.CoreV1().Namespaces().Get(context.TODO(), ns, metav1.GetOptions{})
-				if err == nil {
+			if o.SkipNamespaceValidation {
+				for _, ns := range includeNamespaces {
 					namespacesMap[ns] = true
-				} else {
-					fmt.Fprintf(os.Stderr, "namespace [%s] not found\n", ns)
+				}
+			} else {
+				for _, ns := range includeNamespaces {
+					_, err := clientset.CoreV1().Namespaces().Get(context.TODO(), ns, metav1.GetOptions{})
+					if err == nil {
+						namespacesMap[ns] = true
+					} else {
+						fmt.Fprintf(os.Stderr, "namespace [%s] not found\n", ns)
+					}
 				}
 			}
+		} else if o.SkipNamespaceValidation {
+			fmt.Fprintf(os.Stderr, "--skip-namespace-validation requires --include-namespaces to be set\n")
+			return
 		} else {
 			namespaceList, err := clientset.CoreV1().Namespaces().List(context.TODO(), metav1.ListOptions{})
 			if err != nil {