Do not attempt to list cluster-scoped resources

Unprivledged accounts probably don't have access to these resources.

Fixes #3726

Signed-off-by: David Thompson <[email protected]>

Author: datho7561

src/explorer.ts

@@ -304,11 +304,17 @@ export class OpenShiftExplorer implements TreeDataProvider<ExplorerItem>, Dispos
                 // operator framework is not installed on cluster; do nothing
             }
 
+            const collectableServices: CustomResourceDefinitionStub[] = [];
+            await Promise.all(serviceKinds.map(async serviceKind => {
+                if (await Oc.Instance.canGetKubernetesObjects(serviceKind.name)) {
+                    collectableServices.push(serviceKind);
+                }
+            }));
+
             const toCollect = [
                 Oc.Instance.getKubernetesObjects('Deployment'),
                 Helm.getHelmReleases(),
-                ...serviceKinds
-                    .filter(serviceKind => Oc.Instance.canGetKubernetesObjects(serviceKind.name))
+                ...collectableServices
                     .map(serviceKind => Oc.Instance.getKubernetesObjects(serviceKind.name))
             ];
             if (await Oc.Instance.isOpenShiftCluster()) {

src/oc/ocWrapper.ts

@@ -8,8 +8,8 @@ import * as fs from 'fs/promises';
 import * as tmp from 'tmp';
 import { CommandOption, CommandText } from '../base/command';
 import { CliChannel } from '../cli';
-import { ClusterType, KubernetesConsole } from './types';
 import { Platform } from '../util/platform';
+import { ClusterType, KubernetesConsole } from './types';
 
 /**
  * A wrapper around the `oc` CLI tool.
@@ -243,7 +243,7 @@ export class Oc {
             const result = await CliChannel.getInstance().executeTool(
                 new CommandText('oc', `auth can-i get ${resourceType}`),
             );
-            if (result.stdout === 'yes') {
+            if (result.stdout === 'yes' && result.stderr.indexOf('not namespace scoped') < 0) {
                 return true;
             }
         } catch {