ACM-45223 - ACM-44885: Fix non-admin SSE OOM under large inventory for Go

[Ginxo]

📝 Summary

Backports ACM-44885 / #6638 to the Go GET /events path as part of ACM-42568 / ACM-45223.

Depends on: #6842 (go/migration). This PR should merge into go/migration, not main directly.

Type of Change: 🐞 Bug Fix

---

Problem

Restricted (non-admin) users could drive the console backend into high memory use and CPU saturation on large inventories. After cluster-scoped list SSAR was denied, the Go hub fell through to O(N) per-object SelfSubjectAccessReviews (list namespaced → get) for every cached resource in the SSE snapshot/live stream.

Node fixed the same class of bug in #6638 with two ideas:

1. RBAC short-circuit — one SelfSubjectRulesReview per token+namespace, then local deny-all / allow-all / allow-names decisions (with SSAR confirmation for cluster-scoped kinds).
2. Filter before inflate — do not decompress cached resource blobs until RBAC allows the event.

Only (1) is ported here. That is the change that bounds non-admin inventory filtering and prevents the OOM.

---

What changed (Go)

• SSARAccess.canSee: cluster list SSAR → SelfSubjectRulesReview → local kind decision; SSAR get only for incomplete fallback or cluster-scoped confirmation (RoleBinding in default cannot impersonate ManagedCluster access).
• Caches: hashed token keys, SSRR per namespace, kind-access per namespace+group+resource, per-token SSAR cap (2000), 60s TTL.
• WatchSpec.ClusterScoped: same cluster-scoped kinds as Node CLUSTER_SCOPED_KINDS (ManagedCluster, Namespace, StorageClass, …). Scope is not inferred from metadata.namespace.
• Tests: Go parity with Node eventsAccess.test.ts (e.g. 500 ManagedCluster → 1 SSRR, 0 SSAR get).
• Cleanup: remove orphaned Node TS from the ACM-44885: Fix non-admin SSE OOM under large inventory #6638 merge (backend/src/routes/events*.ts and tests) — not executed by the Go backend.
• Docs: backend/AGENTS.md, docs/ARCHITECTURE.md.

---

Why no zlib resource cache or per-client inflate

The Node backend kept SSE resources in memory as dictionary-compressed zlib blobs (deflateResource / inflateEvent). Each connected client could force decompression to full JSON before RBAC filtering (the pre-#6638 OOM path). #6638 added lightweight meta and filter-before-inflate so denied events never expanded.

The Go backend has a different architecture; those Node mechanisms are not needed for parity:

Node (#6638)	Go (this PR)
In-process resourceCache of zlib Buffers	client-go informer cache — one unstructured copy per resource, shared across clients
RBAC needs meta or inflate to read identity	Identity from Event.Object / GVR without a decompress step
inflateEvent per client before send	writeFiltered → Allow → json.Marshal only if allowed — denied events are never serialized to the wire
zlib on stored resources	gzip/deflate on the SSE HTTP stream (internal/events/hub/encode.go) — compression in transit, not in the event store

So:

• There is no inflate step because nothing is stored as a compressed blob between cache and client.
• There is no per-resource zlib cache because informers already hold the canonical object; duplicating Node’s dictionary+zlib layer would add CPU and complexity without addressing the real Go gap (RBAC O(N)).
• The security and performance invariant we preserve is: do not do expensive per-object authorization work for users who cannot list cluster-scoped resources — achieved here with SSRR, not with compression.

---

Test plan

• go test ./... (hub SSRR tests including 500-cluster scale case)
• golangci-lint on backend
• Manual on hub: kubeadmin vs none user on Inventory — SSE completes, backend RSS/CPU stay bounded (no MOCK_CLUSTERS in Go; regression gate is unit tests above)

---

✅ Checklist

General

• PR title follows the convention (e.g. ACM-12340 Fix bug with...)
• Code builds and runs locally without errors
• No console logs, commented-out code, or unnecessary files
• All commits are meaningful and well-labeled
• All new display strings are externalized for localization (English only)
• (Nice to have) JSDoc comments added for new functions and interfaces

If Bugfix

• Root cause and fix summary are documented in the ticket (for future reference / errata)
• Fix tested thoroughly and resolves the issue (pending hub validation)
• Test(s) added to prevent regression

---

🗒️ Notes for Reviewers

• Compare behavior with Node eventsAccess.ts from ACM-44885: Fix non-admin SSE OOM under large inventory #6638; cluster-scoped SSAR confirmation after non-deny-all SSRR is intentional.
• DELETED events remain unfiltered (bug-compat with Node; documented in backend/AGENTS.md).

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 306 files, which is 6 over the limit of 300.

To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: dff67740-9364-41dc-89e5-a5a0588b9675

📥 Commits

Reviewing files that changed from the base of the PR and between 350856c and 766fdfe.

⛔ Files ignored due to path filters (2)

• backend/go.sum is excluded by !**/*.sum
• backend/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (306)

• .dockerignore
• .editorconfig
• .github/workflows/backend-upgrade.yml
• .tekton/console-acm-51-pull-request.yaml
• .tekton/console-acm-51-push.yaml
• .tekton/console-acm-52-pull-request.yaml
• .tekton/console-acm-52-push.yaml
• .tekton/console-mce-mce-51-pull-request.yaml
• .tekton/console-mce-mce-51-push.yaml
• .tekton/console-mce-mce-52-pull-request.yaml
• .tekton/console-mce-mce-52-push.yaml
• .tool-versions
• .vscode/launch.json
• AGENTS.md
• CONTRIBUTING.md
• Containerfile.acm
• Containerfile.mce
• Makefile.prow
• README.md
• backend/.air.toml
• backend/.gitignore
• backend/.golangci.yml
• backend/.vscode/launch.json
• backend/AGENTS.md
• backend/README.md
• backend/cmd/console/main.go
• backend/eslint.config.mjs
• backend/go.mod
• backend/internal/aggregate/appset.go
• backend/internal/aggregate/argo.go
• backend/internal/aggregate/argo_test.go
• backend/internal/aggregate/clusters.go
• backend/internal/aggregate/engine.go
• backend/internal/aggregate/engine_test.go
• backend/internal/aggregate/fuse.go
• backend/internal/aggregate/fuse_test.go
• backend/internal/aggregate/handler.go
• backend/internal/aggregate/handler_test.go
• backend/internal/aggregate/helper_test.go
• backend/internal/aggregate/lister.go
• backend/internal/aggregate/ocp.go
• backend/internal/aggregate/pages.go
• backend/internal/aggregate/pagination.go
• backend/internal/aggregate/pushmodel.go
• backend/internal/aggregate/rbac.go
• backend/internal/aggregate/rbac_test.go
• backend/internal/aggregate/status.go
• backend/internal/aggregate/status_test.go
• backend/internal/aggregate/transform.go
• backend/internal/aggregate/transform_test.go
• backend/internal/aggregate/types.go
• backend/internal/ansibletower/ansibletower.go
• backend/internal/ansibletower/ansibletower_test.go
• backend/internal/auth/auth.go
• backend/internal/auth/auth_test.go
• backend/internal/auth/ocm.go
• backend/internal/auth/ocm_test.go
• backend/internal/auth/tls.go
• backend/internal/auth/tls_test.go
• backend/internal/clusterinfo/clusterinfo.go
• backend/internal/clusterinfo/clusterinfo_test.go
• backend/internal/clusterproxy/resolver.go
• backend/internal/clusterproxy/resolver_test.go
• backend/internal/config/config.go
• backend/internal/config/config_test.go
• backend/internal/cors/cors.go
• backend/internal/cors/cors_test.go
• backend/internal/events/hub/access.go
• backend/internal/events/hub/access_rules.go
• backend/internal/events/hub/access_rules_test.go
• backend/internal/events/hub/access_ssrr_test.go
• backend/internal/events/hub/access_test.go
• backend/internal/events/hub/encode.go
• backend/internal/events/hub/encode_test.go
• backend/internal/events/hub/event.go
• backend/internal/events/hub/frame.go
• backend/internal/events/hub/frame_test.go
• backend/internal/events/hub/handler.go
• backend/internal/events/hub/handler_test.go
• backend/internal/events/hub/hub.go
• backend/internal/events/hub/hub_test.go
• backend/internal/events/hub/parity_test.go
• backend/internal/events/hub/snapshot.go
• backend/internal/events/hub/snapshot_test.go
• backend/internal/events/rbac/access.go
• backend/internal/events/rbac/handler.go
• backend/internal/events/rbac/handler_test.go
• backend/internal/events/rbac/informer.go
• backend/internal/events/rbac/list.go
• backend/internal/events/rbac/list_test.go
• backend/internal/events/rbac/store.go
• backend/internal/health/health.go
• backend/internal/health/health_test.go
• backend/internal/hubresources/components.go
• backend/internal/hubresources/components_test.go
• backend/internal/hubresources/hubresources.go
• backend/internal/hubresources/hubresources_test.go
• backend/internal/informers/factory.go
• backend/internal/informers/factory_test.go
• backend/internal/informers/gvr.go
• backend/internal/informers/gvr_test.go
• backend/internal/informers/handler.go
• backend/internal/informers/handler_test.go
• backend/internal/informers/retry.go
• backend/internal/informers/retry_test.go
• backend/internal/informers/sink.go
• backend/internal/informers/sink_test.go
• backend/internal/informers/specs.go
• backend/internal/informers/specs_test.go
• backend/internal/informers/store.go
• backend/internal/informers/store_test.go
• backend/internal/informers/transform.go
• backend/internal/informers/transform_test.go
• backend/internal/k8sproxy/k8sproxy.go
• backend/internal/k8sproxy/k8sproxy_test.go
• backend/internal/log/log.go
• backend/internal/mcproxy/mcproxy.go
• backend/internal/mcproxy/mcproxy_test.go
• backend/internal/metricsproxy/metricsproxy.go
• backend/internal/metricsproxy/metricsproxy_test.go
• backend/internal/oauth/oauth.go
• backend/internal/oauth/oauth_test.go
• backend/internal/oauth/revoke.go
• backend/internal/oauth/revoke_test.go
• backend/internal/oauth/token.go
• backend/internal/outbound/transport.go
• backend/internal/placementdebug/ca.go
• backend/internal/placementdebug/ca_test.go
• backend/internal/placementdebug/placementdebug.go
• backend/internal/placementdebug/placementdebug_test.go
• backend/internal/rosa/rosa.go
• backend/internal/rosa/rosa_test.go
• backend/internal/searchapi/discovery.go
• backend/internal/searchapi/searchapi.go
• backend/internal/searchapi/searchapi_test.go
• backend/internal/searchproxy/inject.go
• backend/internal/searchproxy/proxy.go
• backend/internal/searchproxy/proxy_test.go
• backend/internal/searchproxy/ws.go
• backend/internal/server/server.go
• backend/internal/server/server_test.go
• backend/internal/static/public/README
• backend/internal/static/static.go
• backend/internal/static/static_test.go
• backend/internal/upgraderisks/upgraderisks.go
• backend/internal/upgraderisks/upgraderisks_test.go
• backend/internal/user/user.go
• backend/internal/user/user_test.go
• backend/internal/vmproxy/handler.go
• backend/internal/vmproxy/handler_test.go
• backend/internal/vmproxy/hub.go
• backend/internal/vmproxy/hub_test.go
• backend/internal/vmproxy/kubevirt.go
• backend/internal/vmproxy/kubevirt_test.go
• backend/internal/vmproxy/units.go
• backend/internal/vmproxy/units_test.go
• backend/internal/vmproxy/usage.go
• backend/internal/vmproxy/usage_test.go
• backend/package.json
• backend/src/app.ts
• backend/src/lib/agent.ts
• backend/src/lib/authenticated.ts
• backend/src/lib/batch-promise-all.ts
• backend/src/lib/body-parser.ts
• backend/src/lib/compression.ts
• backend/src/lib/config.ts
• backend/src/lib/cookies.ts
• backend/src/lib/cors.ts
• backend/src/lib/delay.ts
• backend/src/lib/fetch-retry.ts
• backend/src/lib/fileWatch.ts
• backend/src/lib/getServiceToken.ts
• backend/src/lib/gigantic.ts
• backend/src/lib/json-request.ts
• backend/src/lib/logger.ts
• backend/src/lib/main.ts
• backend/src/lib/managed-cluster-addon.ts
• backend/src/lib/memory.ts
• backend/src/lib/multi-cluster-engine.ts
• backend/src/lib/multi-cluster-hub.ts
• backend/src/lib/noop.ts
• backend/src/lib/pagination.ts
• backend/src/lib/placementDebugCAWatch.ts
• backend/src/lib/random-string.ts
• backend/src/lib/request-retry.ts
• backend/src/lib/respond.ts
• backend/src/lib/search.ts
• backend/src/lib/server-side-events.ts
• backend/src/lib/server.ts
• backend/src/lib/serviceAccountToken.ts
• backend/src/lib/tlsProfileWatch.ts
• backend/src/lib/token.ts
• backend/src/lib/virtual-machine.ts
• backend/src/resources/resource-list.ts
• backend/src/resources/resource.ts
• backend/src/resources/route.ts
• backend/src/resources/secret.ts
• backend/src/resources/status.ts
• backend/src/resources/watch-options.ts
• backend/src/routes/aggregator.ts
• backend/src/routes/aggregators/appSetData.ts
• backend/src/routes/aggregators/applications.ts
• backend/src/routes/aggregators/applicationsArgo.ts
• backend/src/routes/aggregators/applicationsOCP.ts
• backend/src/routes/aggregators/applicationsPushModel.ts
• backend/src/routes/aggregators/statuses.ts
• backend/src/routes/aggregators/utils.ts
• backend/src/routes/ansibletower.ts
• backend/src/routes/apiPaths.ts
• backend/src/routes/clusterVersion.ts
• backend/src/routes/configure.ts
• backend/src/routes/events.ts
• backend/src/routes/eventsAccess.ts
• backend/src/routes/eventsCache.ts
• backend/src/routes/eventsDefinitions.ts
• backend/src/routes/hub.ts
• backend/src/routes/hypershift-status.ts
• backend/src/routes/liveness.ts
• backend/src/routes/managedClusterProxy.ts
• backend/src/routes/metricsProxy.ts
• backend/src/routes/multiClusterEngineComponents.ts
• backend/src/routes/multiClusterHubComponents.ts
• backend/src/routes/oauth.ts
• backend/src/routes/operatorCheck.ts
• backend/src/routes/placementDebug.ts
• backend/src/routes/proxy.ts
• backend/src/routes/readiness.ts
• backend/src/routes/rosaWizardApi.ts
• backend/src/routes/search.ts
• backend/src/routes/serve.ts
• backend/src/routes/upgrade-risks-prediction.ts
• backend/src/routes/username.ts
• backend/src/routes/userpreference.ts
• backend/src/routes/virtualMachineProxy.ts
• backend/test/app.test.ts
• backend/test/jest-setup.ts
• backend/test/lib/agent.test.ts
• backend/test/lib/batch-promise-all.test.ts
• backend/test/lib/compression.test.ts
• backend/test/lib/fileWatch.test.ts
• backend/test/lib/getServiceToken.test.ts
• backend/test/lib/placementDebugCAWatch.test.ts
• backend/test/lib/server-side-events.test.ts
• backend/test/lib/tlsProfileWatch.test.ts
• backend/test/mock-request.ts
• backend/test/routes/aggregator.test.ts
• backend/test/routes/aggregators/applications.test.ts
• backend/test/routes/aggregators/applicationsArgoMergePush.test.ts
• backend/test/routes/aggregators/applicationsPushModel.test.ts
• backend/test/routes/aggregators/utils.test.ts
• backend/test/routes/ansibletower.test.ts
• backend/test/routes/apiPath.test.ts
• backend/test/routes/clusterVersion.test.ts
• backend/test/routes/configure.test.ts
• backend/test/routes/events.test.ts
• backend/test/routes/eventsAccess.test.ts
• backend/test/routes/eventsCache.test.ts
• backend/test/routes/hub.test.ts
• backend/test/routes/hypershift-status.test.ts
• backend/test/routes/liveness.test.ts
• backend/test/routes/managedClusterProxy.test.ts
• backend/test/routes/metricsProxy.test.ts
• backend/test/routes/operatorCheck.test.ts
• backend/test/routes/ping.test.ts
• backend/test/routes/placementDebug.test.ts
• backend/test/routes/proxy.test.ts
• backend/test/routes/readiness.test.ts
• backend/test/routes/rosaWizardApi.test.ts
• backend/test/routes/search.test.ts
• backend/test/routes/searchWebSocket.test.ts
• backend/test/routes/serve.test.ts
• backend/test/routes/upgrade-risks-prediction.test.ts
• backend/test/routes/username.test.ts
• backend/test/routes/userpreference.test.ts
• backend/test/routes/virtualMachineProxy.test.ts
• backend/test/tsconfig.json
• backend/tsconfig.build.json
• backend/tsconfig.json
• docs/ARCHITECTURE.md
• docs/RESOURCES.md
• frontend/src/components/LoadData.tsx
• frontend/src/components/LoadDataAbstract.test.tsx
• frontend/src/components/LoadDataAbstract.tsx
• frontend/src/components/LoadEventsData.tsx
• frontend/src/components/LoadPluginData.test.tsx
• frontend/src/components/LoadRbacData.test.tsx
• frontend/src/components/LoadRbacData.tsx
• frontend/src/hooks/applyWatchEventsToCache.test.ts
• frontend/src/hooks/applyWatchEventsToCache.ts
• frontend/src/hooks/useWatchEventStream.test.ts
• frontend/src/hooks/useWatchEventStream.ts
• frontend/src/lib/test-event-source.ts
• frontend/src/resources/utils/resource-request.ts
• frontend/webpack.config.ts
• lint-staged.config.js
• package.json
• scripts/air-backend.sh
• scripts/check-hub-alignment.sh
• scripts/console-entrypoint.sh
• scripts/copyright-fix.ts
• scripts/copyright.ts
• scripts/generate-backend-certs.sh
• scripts/golangci-lint-backend.sh
• setup.sh
• sonar-project.properties
• start-ocp-console.sh

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[Ginxo]

/hold

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Ginxo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [Ginxo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sonarqubecloud]

Quality Gate passed

Issues
10 New issues
0 Accepted issues

Measures
0 Security Hotspots
81.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Ginxo]

closed in favor of Ginxo#73