fix: cluster-admin issue

Author: saman2000hoseini

internal/authz/kube.go

@@ -129,6 +129,19 @@ func (k *Kube) ListAllowed(ctx context.Context, sub Subject, act Action) ([]stri
 		return nil, fmt.Errorf("list namespaces: %w", err)
 	}
 
+	// Fast path: if the subject can perform the action CLUSTER-WIDE (a
+	// cluster-admin, or anyone with a cluster-scoped RoleBinding for it), grant
+	// every namespace and skip the per-namespace sweep. A SAR with an empty
+	// namespace checks cluster scope. This both fixes cluster-admins (who the
+	// per-namespace sweep can miss) and is far cheaper (one SAR, not hundreds).
+	if d, err := k.Authorize(ctx, sub, act, ""); err == nil && d.Allowed {
+		all := make([]string, 0, len(nsList.Items))
+		for _, ns := range nsList.Items {
+			all = append(all, ns.Name)
+		}
+		return all, nil
+	}
+
 	var (
 		mu       sync.Mutex
 		allowed  []string

internal/authz/kube_clusterwide_test.go

@@ -0,0 +1,40 @@
+package authz
+
+import (
+	"context"
+	"testing"
+
+	authzv1 "k8s.io/api/authorization/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/kubernetes/fake"
+	k8stesting "k8s.io/client-go/testing"
+)
+
+// clusterAdmin: SAR always allowed → ListAllowed returns every namespace via the
+// cluster-wide fast path (one SAR).
+func TestListAllowedClusterWideFastPath(t *testing.T) {
+	cs := fake.NewSimpleClientset(
+		&corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "team-a"}},
+		&corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "kube-system"}},
+		&corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "openshift-operators"}},
+	)
+	var sarCount int
+	cs.PrependReactor("create", "subjectaccessreviews", func(a k8stesting.Action) (bool, runtime.Object, error) {
+		sarCount++
+		return true, &authzv1.SubjectAccessReview{Status: authzv1.SubjectAccessReviewStatus{Allowed: true}}, nil
+	})
+	k := &Kube{client: cs, listConcurrency: 4}
+
+	got, err := k.ListAllowed(context.Background(), Subject{User: "admin@x"}, Action{Verb: "get", Resource: "pods"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 3 {
+		t.Fatalf("admin should see all namespaces, got %v", got)
+	}
+	if sarCount != 1 {
+		t.Fatalf("cluster-wide fast path should use exactly 1 SAR, used %d", sarCount)
+	}
+}