Skip to content

feat: add skip namespace validation option for RBAC filters #572

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sleeyax wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat: add skip namespace validation option for RBAC filters #572

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1cd0587
feat: add skip namespace validation option for RBAC filters
sleeyax Jan 29, 2026
78484d8
Merge branch 'main' into feat/skip-ns-validation
sleeyax Feb 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions cmd/kor/root.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,7 @@ func addFilterOptionsFlag(cmd *cobra.Command, opts *filters.Options) {
cmd.PersistentFlags().StringSliceVarP(&opts.ExcludeNamespaces, "exclude-namespaces", "e", opts.ExcludeNamespaces, "Namespaces to be excluded, split by commas. Example: --exclude-namespaces ns1,ns2,ns3. If --include-namespaces is set, --exclude-namespaces will be ignored")
cmd.PersistentFlags().StringSliceVarP(&opts.IncludeNamespaces, "include-namespaces", "n", opts.IncludeNamespaces, "Namespaces to run on, split by commas. Example: --include-namespaces ns1,ns2,ns3. If set, non-namespaced resources will be ignored")
cmd.PersistentFlags().BoolVar(&opts.IgnoreOwnerReferences, "ignore-owner-references", false, "Skip resources that have ownerReferences set (for all resource types)")
cmd.PersistentFlags().BoolVar(&opts.SkipNamespaceValidation, "skip-namespace-validation", false, "Skip namespace existence validation (requires --include-namespaces). Use in permission-limited clusters with only Role/RoleBinding")
}

// shouldSkipKubeInitialization determines if a command should skip kubeconfig initialization.
Expand Down
23 changes: 17 additions & 6 deletions pkg/filters/options.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,9 @@ type Options struct {
IncludeNamespaces []string
// IgnoreOwnerReferences skips any resource that has ownerReferences set (for all resource types)
IgnoreOwnerReferences bool
// SkipNamespaceValidation skips validating namespace existence via API calls.
// Use this in permission-limited clusters where you only have namespace-scoped RBAC (Role/RoleBinding).
SkipNamespaceValidation bool

namespace []string
once sync.Once
Expand Down Expand Up @@ -126,15 +129,23 @@ func (o *Options) Namespaces(clientset kubernetes.Interface) []string {
slices.Sort(includeNamespaces)
includeNamespaces = slices.Compact(includeNamespaces)

for _, ns := range includeNamespaces {

_, err := clientset.CoreV1().Namespaces().Get(context.TODO(), ns, metav1.GetOptions{})
if err == nil {
if o.SkipNamespaceValidation {
for _, ns := range includeNamespaces {
namespacesMap[ns] = true
} else {
fmt.Fprintf(os.Stderr, "namespace [%s] not found\n", ns)
}
} else {
for _, ns := range includeNamespaces {
_, err := clientset.CoreV1().Namespaces().Get(context.TODO(), ns, metav1.GetOptions{})
if err == nil {
namespacesMap[ns] = true
} else {
fmt.Fprintf(os.Stderr, "namespace [%s] not found\n", ns)
}
}
}
} else if o.SkipNamespaceValidation {
fmt.Fprintf(os.Stderr, "--skip-namespace-validation requires --include-namespaces to be set\n")
return
} else {
namespaceList, err := clientset.CoreV1().Namespaces().List(context.TODO(), metav1.ListOptions{})
if err != nil {
Expand Down