Speed up Console namespace loading and refresh choices automatically
What type of PR is this?
/kind bug
What this PR does / why we need it:
Console startup waits for authorization checks across every namespace before applying the remembered namespace. With 20 namespaces and access to Sessions in only one, discovery makes 191 authorization requests and the default client rate limit can add about 36 seconds of waiting.
Validate the remembered namespace (or configured default) first, then load the remaining namespace choices in the background. If that namespace is unavailable, retain full discovery and the existing fallback selection. Give authorization checks a dedicated client with a 50 QPS / 100 burst budget while retaining the eight concurrent namespace checks and uncached authorization decisions.
The focused namespace lookup uses a name-filtered list, so it works with the existing Console service-account permissions. Access through groups and custom roles remains supported.
Refresh namespace choices when the user opens or focuses the picker, and remove the separate refresh button. Mouse, touch, and keyboard interactions share any pending discovery request and retain the current selection while it remains accessible. Unchanged choices retain their existing option nodes and selected value, including the no-access placeholder. Keep the picker usable after an error or when access is empty, so reopening it can recover without a page reload.
Which issue(s) this PR is related to:
N/A
Special notes for your reviewer:
Validation passed:
env -u CODEX_HOME -u CODEX_AUTH_JSON make test TEST_FLAGS='-p 4'— isolate the entrypoint tests from this agent session's Codex settings.make test-integration TEST_FLAGS='-run TestConsoleMembership -count=1'— verifies the focused lookup against Kubernetes RBAC, including missing, inaccessible, and revoked namespaces.make verify— generated browser bundle, formatting, and vet.- Chromium comparison using the base and branch browser bundles, identical API fixtures, and a pending full namespace-discovery request; both finish discovery without browser errors.
- Chromium checks for mouse, keyboard, and touch opening, selection preservation, pending-request coalescing, newly granted access, and recovery after namespace loading fails.
Review follow-up:
- Corrected the chart README to tell users to reopen the namespace dropdown after access changes.
- Addressed the redundant option replacement in the picker review: unchanged results leave the option nodes and selected value untouched. Behavior tests cover repeated mouse, touch, keyboard, and focus refreshes, the empty-access placeholder, and subsequent access grants.
- The broader request to defer changed options while a native popup is open remains unconfirmed: the prior Chromium checks selected newly discovered options without reopening the picker. Actual additions/removals still update immediately; macOS/Safari native menus have not been validated. No popup-state workaround or authorization cache was added.
A local measurement with 20 namespace fixtures and a real rate-limited authorization client returned the same accessible namespace:
| Request | Authorization calls | Elapsed |
|---|---|---|
| Full discovery, default client limits | 191 | 36.20 s |
| Full discovery, configured client limits | 191 | 1.82 s |
| Focused selected-namespace lookup | 1 | 2.4 ms |
These measurements use a local authorization server, not a production cluster. Two simultaneous full-discovery requests shared the configured budget and completed 382 checks in 5.64 seconds.
Before — Admin while full namespace discovery is pending. The remembered namespace is not yet selected, so members and configuration cannot load.
After — The same Admin view, remembered namespace, fixture data, and 1440×1080 viewport while full discovery is still pending. The validated namespace is already selected and its members and configuration are usable. Opening the picker refreshes its choices without a separate button.
Does this PR introduce a user-facing change?
The Console opens an accessible remembered or default namespace while other namespaces load in the background, reduces namespace discovery delays for OIDC and GitHub sign-in, and refreshes namespace choices automatically when the picker is opened or focused.
Summary by cubic
Speeds up Console startup by validating the remembered or default namespace before full discovery, so an accessible namespace is usable immediately, and refreshes namespace choices automatically when the picker is opened or focused.
- Checks the preferred namespace first via a name-filtered list and loads the rest in the background; falls back to full discovery when the preferred namespace is unavailable.
- Gives authorization checks a dedicated client with 50 QPS / 100 burst, reducing an accessible namespace's discovery from ~191 requests and 36 seconds to a single request.
- Removes the separate refresh button; opening or focusing the picker reloads options, coalesces in-flight requests, preserves the current selection, and stays usable after errors or when access is empty.