UI/API: Add autocomplete for namespace filter

[thegreymatter]

Summary

Add the ability to autocomplete the namespace filter in "Workflow Template" and "Workflow" screens using the already available namespaces in the cluster.

Use Cases

In our specific use case, we build and destroy namespaces dynamically per development or production branch. and use these namespaces a the isolation level for our different workflows. selecting these namespaces in the UI for the first time is a bit cumbersome, as we need to type them in manually.

---

Message from the maintainers:

Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

[alexec]

For this feature, I think we should make it opt in for the namespace. I.e. the namespace should be labelled with something like workflows.argoproj.io/ui: Allow for them to appear in the list automatiaclly. In multi-tentant systems, you will not want users to determine what the other namespaces are.

[alexec]

This will require a new ListNamespaces endpoint.

[thegreymatter]

For this feature, I think we should make it opt in for the namespace. I.e. the namespace should be labelled with something like workflows.argoproj.io/ui: Allow for them to appear in the list automatiaclly. In multi-tentant systems, you will not want users to determine what the other namespaces are.

i would like to start working on this capability in a couple of days. I am wondering about the opt-in labels. shouldn't RBAC and namespace permissions solve that for us in a more standardized way?

The label solution creates a split responsibility, as RBAC is responsible for "where I can run", while the labels are responsible to "where I can I can run".

Thoughts?

[JoKuebler]

For this feature, I think we should make it opt in for the namespace. I.e. the namespace should be labelled with something like workflows.argoproj.io/ui: Allow for them to appear in the list automatiaclly. In multi-tentant systems, you will not want users to determine what the other namespaces are.

i would like to start working on this capability in a couple of days. I am wondering about the opt-in labels. shouldn't RBAC and namespace permissions solve that for us in a more standardized way?

The label solution creates a split responsibility, as RBAC is responsible for "where I can run", while the labels are responsible to "where I can I can run".

Thoughts?

@thegreymatter are you still interested in working on this? I do like the idea of having a label as a mechanism to control which namespaces are shown. Prevents users from dealing with RBAC settings which could depending on the cluster be quite complicated sometimes, at least in my little experience.

I'd even extend this improvement to make the namespace filter independent for each screen. Example: My workflows run in a namespace "argo-workflows" but my sensors are deployed to "argo-events". So switching from the "Workflows" to the "Sensors" screen I always have to adjust the namespace filter field.

I'd be happy to support here.

[agilgur5]

In #9140 (comment), I did mention a tiny alternative that could work for a bit of autocomplete but wouldn't show all namespaces: we could pull a list of namespaces from displayed workflows.

Otherwise, having user RBAC control namespace visibility as above is the proper way of doing this, both within the k8s RBAC model (i.e. no bypasses or vulnerabilities by working around it) and consistency with all existing permissions in the API that are based purely on k8s RBAC.

I mentioned in my linked comment that many users won't have namespace list permissions, and that does indeed mean that they shouldn't be able to list them -- that would be correct. The workaround of retrieving them from displayed workflows means that users had access to those namespaces for the list workflows, so would also be correct