feat: add built-in project dashboard - #21
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1bacf2d2cd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| func NewHandler(reader client.Reader) http.Handler { | ||
| dashboardHandler := &handler{reader: reader} | ||
| mux := http.NewServeMux() | ||
| mux.HandleFunc("GET /api/projects", dashboardHandler.listProjects) |
There was a problem hiding this comment.
In multi-tenant clusters without restrictive NetworkPolicies, any pod that reaches the new dashboard ClusterIP can call this unauthenticated handler. Because it uses the operator's cluster-wide APIReader, namespace-restricted tenants can bypass Kubernetes RBAC to enumerate project names, IDs, namespaces, and status across the cluster, and can trigger unbounded direct API-server list requests; require authentication and authorization or limit results to the caller's authorized scope.
Useful? React with 👍 / 👎.
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| name: {{ printf "%s-dashboard" (include "supabase-operator.fullname" .) }} |
There was a problem hiding this comment.
When the generated fullname exceeds 53 characters, appending -dashboard produces a Service name longer than Kubernetes' 63-character limit because the fullname helper truncates only before this suffix is added. For example, an installation using a long fullnameOverride and metricsService.enabled=false previously rendered valid resources but is now rejected for this Service; truncate the final suffixed name as the webhook service helper does.
Useful? React with 👍 / 👎.
1 participant
Problem
SupabaseProject status is only visible through Kubernetes tools.
Solution
Add a read-only dashboard served by the operator and available by default.
Major Changes
Part of #18