portForwarding requires access outside developer's namespace

[ramukima]

Expected behavior

Resource search for port-forwarding must be scoped to the namespace specified in PortForwardResource.

Actual behavior

Failed to port forward with k8s RBAC error - User does not have access to view resource at Cluster level.

Information

• Skaffold version: 0.34
• Operating system: OSX
• Contents of skaffold.yaml:

apiVersion: skaffold/v1beta13
kind: Config
build:
  artifacts:
  - image: <...>/simple-service
deploy:
  kubectl:
    manifests:
    - k8s/*
portForward:
- resourceType: Service
  resourceName: simple-service
  namespace: ramukima
  port: 8080
  localPort: 8080

Steps to reproduce the behavior

1. Developer does not have access to CRUD any resource outside of his/her own namespace
2. kubeconfig uses user's access token
3. skaffold dev --port-forward

Example Reference requiring Cluster level access for resource lookup - https://github.com/GoogleContainerTools/skaffold/blob/master/pkg/skaffold/kubernetes/portforward/resource_forwarder.go#L109

[balopat]

Thank you for filing this!
I agree, this should work - the following way: user should be able to narrow Skaffold to a namespace via the namespace setting (--namespace or SKAFFOLD_NAMESPACE env var) - however on that exact line we don't pass the namespace currently.

[balopat]

Also related to #2502

[corneliusweig]

Also see #2495 (comment)

[tejal29]

Depends in #2640

[priyawadhwa]

Hey @ramukima we just merged #2651 which should fix this issue -- would you be able to test the bleeding edge binary and see if that solves your issue? Installation instructions can be found here

[ramukima]

@priyawadhwa Thank you for the fix. I tried it on my mac and it works perfectly fine. This issue can be marked fixed.

The only follow up question is -

Do I have to explicitly specify --port-forward to skaffold, even if I have a portForward resource specified in skaffold.yaml ?

[ramukima]

Never mind - https://skaffold.dev/docs/how-tos/portforward/ clearly specifies - "Port forwarding is set to false by default; it is enabled with the --port-forward flag. If this flag is not set, no port forwarding will occur". Closing this issue.