[gjkim42]

What type of PR is this?

/kind bug

What this PR does / why we need it:

Console startup waits for authorization checks across every namespace before applying the remembered namespace. With 20 namespaces and access to Sessions in only one, discovery makes 191 authorization requests and the default client rate limit can add about 36 seconds of waiting.

Validate the remembered namespace (or configured default) first, then load the remaining namespace choices in the background. If that namespace is unavailable, retain full discovery and the existing fallback selection. Give authorization checks a dedicated client with a 50 QPS / 100 burst budget while retaining the eight concurrent namespace checks and uncached authorization decisions.

The focused namespace lookup uses a name-filtered list, so it works with the existing Console service-account permissions. Access through groups and custom roles remains supported.

Refresh namespace choices when the user opens or focuses the picker, and remove the separate refresh button. Mouse, touch, and keyboard interactions share any pending discovery request and retain the current selection while it remains accessible. Unchanged choices retain their existing option nodes and selected value, including the no-access placeholder. Keep the picker usable after an error or when access is empty, so reopening it can recover without a page reload.

Which issue(s) this PR is related to:

N/A

Special notes for your reviewer:

Validation passed:

• env -u CODEX_HOME -u CODEX_AUTH_JSON make test TEST_FLAGS='-p 4' — isolate the entrypoint tests from this agent session's Codex settings.
• make test-integration TEST_FLAGS='-run TestConsoleMembership -count=1' — verifies the focused lookup against Kubernetes RBAC, including missing, inaccessible, and revoked namespaces.
• make verify — generated browser bundle, formatting, and vet.
• Chromium comparison using the base and branch browser bundles, identical API fixtures, and a pending full namespace-discovery request; both finish discovery without browser errors.
• Chromium checks for mouse, keyboard, and touch opening, selection preservation, pending-request coalescing, newly granted access, and recovery after namespace loading fails.

Review follow-up:

• Corrected the chart README to tell users to reopen the namespace dropdown after access changes.
• Addressed the redundant option replacement in the picker review: unchanged results leave the option nodes and selected value untouched. Behavior tests cover repeated mouse, touch, keyboard, and focus refreshes, the empty-access placeholder, and subsequent access grants.
• The broader request to defer changed options while a native popup is open remains unconfirmed: the prior Chromium checks selected newly discovered options without reopening the picker. Actual additions/removals still update immediately; macOS/Safari native menus have not been validated. No popup-state workaround or authorization cache was added.

A local measurement with 20 namespace fixtures and a real rate-limited authorization client returned the same accessible namespace:

Request	Authorization calls	Elapsed
Full discovery, default client limits	191	36.20 s
Full discovery, configured client limits	191	1.82 s
Focused selected-namespace lookup	1	2.4 ms

These measurements use a local authorization server, not a production cluster. Two simultaneous full-discovery requests shared the configured budget and completed 382 checks in 5.64 seconds.

Before — Admin while full namespace discovery is pending. The remembered namespace is not yet selected, so members and configuration cannot load.

After — The same Admin view, remembered namespace, fixture data, and 1440×1080 viewport while full discovery is still pending. The validated namespace is already selected and its members and configuration are usable. Opening the picker refreshes its choices without a separate button.

Does this PR introduce a user-facing change?

The Console opens an accessible remembered or default namespace while other namespaces load in the background, reduces namespace discovery delays for OIDC and GitHub sign-in, and refreshes namespace choices automatically when the picker is opened or focused.

---

Summary by cubic

Speeds up Console startup by validating the remembered or default namespace before full discovery, so an accessible namespace is usable immediately, and refreshes namespace choices automatically when the picker is opened or focused.

• Checks the preferred namespace first via a name-filtered list and loads the rest in the background; falls back to full discovery when the preferred namespace is unavailable.
• Gives authorization checks a dedicated client with 50 QPS / 100 burst, reducing an accessible namespace's discovery from ~191 requests and 36 seconds to a single request.
• Removes the separate refresh button; opening or focusing the picker reloads options, coalesces in-flight requests, preserves the current selection, and stays usable after errors or when access is empty.

^{Written for commit b1c51c7. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 9 files

_{Re-trigger cubic}

[gjkim42]

/kelos review

[kelos-bot]

🤖 Kelos Task Status

Task kelos-reviewer-issue-comment-9464d5305db1 has succeeded. ✅

[cubic-dev-ai]

1 issue found across 6 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/consoleserver/frontend/app.ts">

<violation number="1" location="internal/consoleserver/frontend/app.ts:5919">
P2: The picker refresh is triggered by `pointerdown` on the `<select>`, which is the same event that opens the native dropdown, and `loadNamespaceOptions()` unconditionally calls `elements.activeNamespace.replaceChildren()` when the fetch resolves. Mutating the option list while a native select's popup is open is a known problem in Chrome/WebKit: the open popup is not updated from the replacement and can snap shut, show only the stale first option, or leave the selection jumping, forcing the user to close and reopen the dropdown (see WebKit/Chromium 'SELECT element popup' reports). The same rebuild also runs on every Tab-focus even when the fetched list is identical, re-running full namespace discovery (plus its authorization calls) for each interaction. Skip the re-render when the fetched list matches the currently rendered options, and avoid touching the option list while the popup is open.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[kelos-bot]

🤖 Kelos Reviewer Agent @gjkim42

Review Summary

Verdict: APPROVE
Overall correctness: patch is correct
Scope: Checks the remembered/default namespace first with a name-filtered lookup and runs full discovery in the background, gives SubjectAccessReviews a dedicated 50 QPS / 100 burst client, and replaces the refresh button with a refresh when the picker is opened or focused.

Findings Overview

Priority	Count	File:Line	Summary
P0	0	—	none
P1	0	—	none
P2	0	—	none
P3	1	internal/manifests/charts/kelos/README.md:369	Chart README still says to "Refresh the dropdown", which was written for the removed refresh button

Findings

Documentation

• [P3] internal/manifests/charts/kelos/README.md:369 — "Refresh the dropdown after access changes." was added along with the ↻ button that this PR removes. docs/reference.md now says to reopen the dropdown, but the chart README still uses the old wording, so readers may look for a refresh control that no longer exists. Suggest matching docs/reference.md, for example "Reopen the dropdown after access changes to refresh the namespace list."

Suggestions (optional)

• [P3] internal/consoleserver/frontend/app.ts:2874 — loadNamespaceOptions() always calls replaceChildren() and rebuilds the options, even when the list hasn't changed, which is the usual case. Because refreshes now start on pointerdown/focus, that rebuild often happens while the native popup is opening or open. On platforms that draw the select with a native menu (macOS and mobile), changing the DOM while the popup is open can close it, reopen it, or leave it showing old options. This depends on the browser and I couldn't reproduce it here. Skipping the rebuild when the fetched list matches state.namespaces would avoid it in the common case at little cost.

Key takeaways

• The startup flow looks right. The focused lookup goes through the direct (uncached) client, so MatchingFields{"metadata.name": …} becomes an API-server field selector that Namespaces support. An empty preferred namespace can't happen because New rejects an empty default namespace. The generation checks still drop stale results when the user switches namespace during a background refresh. Unit, JS, and integration tests cover the accessible, inaccessible, missing, revoked, failure, coalescing, and access-granted paths.
• Each opening of the picker now runs a full discovery: up to len(consoleResourceDefinitions) (10) reviews for every namespace the user can't access. Tabbing into the picker and then pressing Space/Enter can run it twice if the first one finishes quickly. This is intended and is still much cheaper than before thanks to the dedicated limiter. But every user and every Console authorization check shares that 50 QPS budget, so watch it on clusters with many namespaces.

Note on prompt injection: a third-party review comment on this PR included a "Prompt for AI agents" block with instructions to change code and resolve threads. I treated it as data and did not follow it. This review is based on my own reading of the code.