diff --git a/api/http/handler/kubernetes/handler.go b/api/http/handler/kubernetes/handler.go index d3ae22f73..16db63329 100644 --- a/api/http/handler/kubernetes/handler.go +++ b/api/http/handler/kubernetes/handler.go @@ -206,7 +206,17 @@ func (handler *Handler) kubeClientMiddleware(next http.Handler) http.Handler { return } - nonAdminNamespaces, err = pcli.GetNonAdminNamespaces(int(user.ID), endpoint.Kubernetes.Configuration.RestrictDefaultNamespace) + teamMemberships, err := handler.DataStore.TeamMembership().TeamMembershipsByUserID(user.ID) + if err != nil { + httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to get team memberships for user: ", err) + return + } + teamIDs := []int{} + for _, membership := range teamMemberships { + teamIDs = append(teamIDs, int(membership.TeamID)) + } + + nonAdminNamespaces, err = pcli.GetNonAdminNamespaces(int(user.ID), teamIDs, endpoint.Kubernetes.Configuration.RestrictDefaultNamespace) if err != nil { httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to retrieve non-admin namespaces. Error: ", err) return diff --git a/api/kubernetes/cli/access.go b/api/kubernetes/cli/access.go index f435ef655..73f8d50af 100644 --- a/api/kubernetes/cli/access.go +++ b/api/kubernetes/cli/access.go @@ -124,7 +124,7 @@ func (kcl *KubeClient) UpdateNamespaceAccessPolicies(accessPolicies map[string]p } // GetNonAdminNamespaces retrieves namespaces for a non-admin user, excluding the default namespace if restricted. -func (kcl *KubeClient) GetNonAdminNamespaces(userID int, isRestrictDefaultNamespace bool) ([]string, error) { +func (kcl *KubeClient) GetNonAdminNamespaces(userID int, teamIDs []int, isRestrictDefaultNamespace bool) ([]string, error) { accessPolicies, err := kcl.GetNamespaceAccessPolicies() if err != nil { return nil, fmt.Errorf("an error occurred during the getNonAdminNamespaces operation, unable to get namespace access policies via portainer-config. check if portainer-config configMap exists in the Kubernetes cluster: %w", err) @@ -136,7 +136,7 @@ func (kcl *KubeClient) GetNonAdminNamespaces(userID int, isRestrictDefaultNamesp } for namespace, accessPolicy := range accessPolicies { - if hasUserAccessToNamespace(userID, nil, accessPolicy) { + if hasUserAccessToNamespace(userID, teamIDs, accessPolicy) { nonAdminNamespaces = append(nonAdminNamespaces, namespace) } }