From bd29af5803f24b4bb9eee6d4b3600223b8c4d1a3 Mon Sep 17 00:00:00 2001 From: Nicholas Yancey Date: Fri, 29 May 2026 15:47:49 -0400 Subject: [PATCH 1/6] Hides --namespace flag from nonadmin commands --- cmd/root.go | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/cmd/root.go b/cmd/root.go index 429827a4..9070b819 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -451,7 +451,12 @@ func NewVeleroRootCommand(baseName string) *cobra.Command { c.AddCommand(nabsl.NewNABSLRequestCommand(f)) // Custom subcommands - use NonAdmin factory - c.AddCommand(nonadmin.NewNonAdminCommand(f)) + nonadminCmd := nonadmin.NewNonAdminCommand(f) + c.AddCommand(nonadminCmd) + + // Hide --namespace flag from nonadmin commands + // NonAdmin operations are namespace-scoped to the user's current context for security + hideNamespaceFlagFromCommand(nonadminCmd) // Must-gather command - diagnostic tool c.AddCommand(mustgather.NewMustGatherCommand(f)) @@ -501,3 +506,18 @@ func NewVeleroRootCommand(baseName string) *cobra.Command { c.PersistentFlags().AddGoFlagSet(flag.CommandLine) return c } + +// hideNamespaceFlagFromCommand recursively hides the --namespace flag from a command and all its subcommands +func hideNamespaceFlagFromCommand(cmd *cobra.Command) { + // Hide from both local and inherited (persistent) flags + if flag := cmd.LocalFlags().Lookup("namespace"); flag != nil { + flag.Hidden = true + } + if flag := cmd.InheritedFlags().Lookup("namespace"); flag != nil { + flag.Hidden = true + } + // Recursively hide from all subcommands + for _, subCmd := range cmd.Commands() { + hideNamespaceFlagFromCommand(subCmd) + } +} From 11cb0cefba3943076074609c34377799281b16ed Mon Sep 17 00:00:00 2001 From: Nicholas Yancey Date: Mon, 1 Jun 2026 09:07:05 -0400 Subject: [PATCH 2/6] Hiding namespace flag when used in nonadmin help --- cmd/root.go | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/cmd/root.go b/cmd/root.go index 9070b819..1292dcb5 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -509,14 +509,19 @@ func NewVeleroRootCommand(baseName string) *cobra.Command { // hideNamespaceFlagFromCommand recursively hides the --namespace flag from a command and all its subcommands func hideNamespaceFlagFromCommand(cmd *cobra.Command) { - // Hide from both local and inherited (persistent) flags - if flag := cmd.LocalFlags().Lookup("namespace"); flag != nil { - flag.Hidden = true - } - if flag := cmd.InheritedFlags().Lookup("namespace"); flag != nil { - flag.Hidden = true - } - // Recursively hide from all subcommands + // For each command, we need to hide the inherited namespace flag in its help output + // We do this by overriding the HelpFunc to filter out the namespace flag + originalHelpFunc := cmd.HelpFunc() + cmd.SetHelpFunc(func(c *cobra.Command, args []string) { + // Temporarily hide the namespace flag for this help output + if flag := c.InheritedFlags().Lookup("namespace"); flag != nil { + flag.Hidden = true + defer func() { flag.Hidden = false }() + } + originalHelpFunc(c, args) + }) + + // Recursively apply to all subcommands for _, subCmd := range cmd.Commands() { hideNamespaceFlagFromCommand(subCmd) } From 3cddc5d874bc917a6efae11109535855b6c2ee1a Mon Sep 17 00:00:00 2001 From: Nicholas Yancey Date: Mon, 1 Jun 2026 10:57:18 -0400 Subject: [PATCH 3/6] Fixed --namespace flag in nonadmin command --- cmd/root.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/cmd/root.go b/cmd/root.go index 1292dcb5..2246e440 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -515,8 +515,9 @@ func hideNamespaceFlagFromCommand(cmd *cobra.Command) { cmd.SetHelpFunc(func(c *cobra.Command, args []string) { // Temporarily hide the namespace flag for this help output if flag := c.InheritedFlags().Lookup("namespace"); flag != nil { + originalHidden := flag.Hidden flag.Hidden = true - defer func() { flag.Hidden = false }() + defer func() { flag.Hidden = originalHidden }() } originalHelpFunc(c, args) }) From 3d30709e774cdbfa5a9994a550b0ae1e05ea7572 Mon Sep 17 00:00:00 2001 From: Nicholas Yancey Date: Mon, 1 Jun 2026 12:25:52 -0400 Subject: [PATCH 4/6] Hiding --namespace flag in nonadmin command --- cmd/root.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/cmd/root.go b/cmd/root.go index 2246e440..f3d3d65f 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -458,6 +458,14 @@ func NewVeleroRootCommand(baseName string) *cobra.Command { // NonAdmin operations are namespace-scoped to the user's current context for security hideNamespaceFlagFromCommand(nonadminCmd) + // Reject --namespace flag if used with nonadmin commands + nonadminCmd.PersistentPreRunE = func(cmd *cobra.Command, args []string) error { + if cmd.Flags().Changed("namespace") { + return fmt.Errorf("-n/--namespace is not supported for nonadmin commands; namespace is determined by your current context") + } + return nil + } + // Must-gather command - diagnostic tool c.AddCommand(mustgather.NewMustGatherCommand(f)) From 6c7c6e33bce72560cf5445581a25529c1c16165b Mon Sep 17 00:00:00 2001 From: Nicholas Yancey Date: Mon, 1 Jun 2026 13:22:36 -0400 Subject: [PATCH 5/6] Hiding --namespace flag in nonadmin command --- cmd/root.go | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/cmd/root.go b/cmd/root.go index f3d3d65f..693a10d1 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -517,9 +517,11 @@ func NewVeleroRootCommand(baseName string) *cobra.Command { // hideNamespaceFlagFromCommand recursively hides the --namespace flag from a command and all its subcommands func hideNamespaceFlagFromCommand(cmd *cobra.Command) { - // For each command, we need to hide the inherited namespace flag in its help output - // We do this by overriding the HelpFunc to filter out the namespace flag - originalHelpFunc := cmd.HelpFunc() + // Get the default Cobra help function before we start modifying anything + // This avoids infinite recursion if HelpFunc gets called multiple times + defaultHelpFunc := cmd.HelpFunc() + + // Set custom help function that hides namespace flag cmd.SetHelpFunc(func(c *cobra.Command, args []string) { // Temporarily hide the namespace flag for this help output if flag := c.InheritedFlags().Lookup("namespace"); flag != nil { @@ -527,7 +529,8 @@ func hideNamespaceFlagFromCommand(cmd *cobra.Command) { flag.Hidden = true defer func() { flag.Hidden = originalHidden }() } - originalHelpFunc(c, args) + // Call the default help function, not cmd.HelpFunc() which would cause recursion + defaultHelpFunc(c, args) }) // Recursively apply to all subcommands From 93dfcc40e3dff5b2904ecfb3e1c008276dbd9747 Mon Sep 17 00:00:00 2001 From: Nicholas Yancey Date: Mon, 1 Jun 2026 14:47:41 -0400 Subject: [PATCH 6/6] Hiding --namespace flag in nonadmin command --- cmd/root.go | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-) diff --git a/cmd/root.go b/cmd/root.go index 693a10d1..b95ca4f2 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -517,21 +517,9 @@ func NewVeleroRootCommand(baseName string) *cobra.Command { // hideNamespaceFlagFromCommand recursively hides the --namespace flag from a command and all its subcommands func hideNamespaceFlagFromCommand(cmd *cobra.Command) { - // Get the default Cobra help function before we start modifying anything - // This avoids infinite recursion if HelpFunc gets called multiple times - defaultHelpFunc := cmd.HelpFunc() - - // Set custom help function that hides namespace flag - cmd.SetHelpFunc(func(c *cobra.Command, args []string) { - // Temporarily hide the namespace flag for this help output - if flag := c.InheritedFlags().Lookup("namespace"); flag != nil { - originalHidden := flag.Hidden - flag.Hidden = true - defer func() { flag.Hidden = originalHidden }() - } - // Call the default help function, not cmd.HelpFunc() which would cause recursion - defaultHelpFunc(c, args) - }) + // Mark the command so we can identify it needs the namespace flag hidden + // We'll handle this in a PersistentPreRun hook to avoid modifying the shared flag object + cmd.Annotations = map[string]string{"hide-namespace-flag": "true"} // Recursively apply to all subcommands for _, subCmd := range cmd.Commands() {