Fixes cluster-admin seeing a completely empty UI

[foot]

Fixes allowing cluster-admin and other users with * permissions in their RBAC rules from using the UI.

Prior to this our rule engine determined that cluster-admin couldn't see any namespaces as we didn't take * into account.

What changed?

Adds support for evaluating * in the various positions it can appear ({ "verbs": ["*"], "apiGroups": ["*"], "resources": ["*"] }) when evaluating the rules that determine which Namespaces we think a user has access to.

Why was this change made?

Its common for people to use cluster-admin when debugging permissions as cluster-admin should be able to see everything.

How was this change implemented?

Updates to our rules engine.

How did you validate the change?

Only with unit tests so far.

[foot]

For reference this is what a SelfSubjectReviews response for cluster-admin looks like:

{
  "metadata": { "creationTimestamp": null },
  "spec": {},
  "status": {
    "resourceRules": [
      {
        "verbs": ["create"],
        "apiGroups": ["authorization.k8s.io"],
        "resources": ["selfsubjectaccessreviews", "selfsubjectrulesreviews"]
      },
      { "verbs": ["*"], "apiGroups": ["*"], "resources": ["*"] }
    ],
    "nonResourceRules": [
      {
        "verbs": ["get"],
        "nonResourceURLs": [
          "/healthz",
          "/livez",
          "/readyz",
          "/version",
          "/version/"
        ]
      },
      {
        "verbs": ["get"],
        "nonResourceURLs": [
          "/api",
          "/api/*",
          "/apis",
          "/apis/*",
          "/healthz",
          "/livez",
          "/openapi",
          "/openapi/*",
          "/readyz",
          "/version",
          "/version/"
        ]
      },
      { "verbs": ["*"], "nonResourceURLs": ["*"] }
    ],
    "incomplete": true,
    "evaluationError": "webhook authorizer does not support user rule resolution"
  }
}

[alexandermarston]

👍 would be great to have this merged, fixes some issues we're having with cluster access

@foot any plans to push this through?

[foot]

Sorry! Got distracted. Will try and wrap this up for the next release

[jpellizzari]

LGTM, love the extra comments 👍