This is an automated email from the ASF dual-hosted git repository.
squakez pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-k.git
The following commit(s) were added to refs/heads/main by this push:
new 2653b794a fix(install): namespace get cluster role
2653b794a is described below
commit 2653b794a6c94a76ed5174da7b16add78a319187
Author: Pasquale Congiusti <[email protected]>
AuthorDate: Mon Nov 9 16:51:29 2026 +0100
fix(install): namespace get cluster role
Ref #6855
---
helm/camel-k/templates/rbacs-common.yaml | 29 ++++++++++++++++++++++
helm/camel-k/templates/rbacs-descoped.yaml | 8 ------
helm/camel-k/templates/rbacs-namespaced.yaml | 8 ------
pkg/platform/profile.go | 13 +++++-----
.../rbac/descoped/operator-cluster-role.yaml | 8 ------
...ml => get-namespaces-cluster-role-binding.yaml} | 28 ++++++++++-----------
...ation.yaml => get-namespaces-cluster-role.yaml} | 28 ++++++++++-----------
pkg/resources/config/rbac/kustomization.yaml | 2 ++
.../config/rbac/namespaced/operator-role.yaml | 8 ------
pkg/util/kubernetes/lookup.go | 4 +++
10 files changed, 67 insertions(+), 69 deletions(-)
diff --git a/helm/camel-k/templates/rbacs-common.yaml
b/helm/camel-k/templates/rbacs-common.yaml
index 8b794597b..4df1868df 100644
--- a/helm/camel-k/templates/rbacs-common.yaml
+++ b/helm/camel-k/templates/rbacs-common.yaml
@@ -171,6 +171,20 @@ rules:
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ labels:
+ app: camel-k
+ name: {{ include "camel-k.fullname" . }}-operator-namespaces
+rules:
+- apiGroups:
+ - ""
+ resources:
+ - namespaces
+ verbs:
+ - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
@@ -226,3 +240,18 @@ subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:authenticated
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+ labels:
+ app: camel-k
+ name: {{ include "camel-k.fullname" . }}-operator-namespaces
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: {{ include "camel-k.fullname" . }}-operator-namespaces
+subjects:
+- kind: ServiceAccount
+ name: {{ include "camel-k.fullname" . }}-operator
+ namespace: '{{ .Release.Namespace }}'
diff --git a/helm/camel-k/templates/rbacs-descoped.yaml
b/helm/camel-k/templates/rbacs-descoped.yaml
index f52bdea60..2a57524c2 100644
--- a/helm/camel-k/templates/rbacs-descoped.yaml
+++ b/helm/camel-k/templates/rbacs-descoped.yaml
@@ -83,14 +83,6 @@ rules:
- get
- list
- watch
-- apiGroups:
- - ""
- resources:
- - namespaces
- verbs:
- - get
- - list
- - watch
- apiGroups:
- ""
resources:
diff --git a/helm/camel-k/templates/rbacs-namespaced.yaml
b/helm/camel-k/templates/rbacs-namespaced.yaml
index f4e2c5a83..2b3bbbb9c 100644
--- a/helm/camel-k/templates/rbacs-namespaced.yaml
+++ b/helm/camel-k/templates/rbacs-namespaced.yaml
@@ -83,14 +83,6 @@ rules:
- get
- list
- watch
-- apiGroups:
- - ""
- resources:
- - namespaces
- verbs:
- - get
- - list
- - watch
- apiGroups:
- ""
resources:
diff --git a/pkg/platform/profile.go b/pkg/platform/profile.go
index fea6cc27c..9c9de866b 100644
--- a/pkg/platform/profile.go
+++ b/pkg/platform/profile.go
@@ -20,7 +20,7 @@ package platform
import (
"context"
- corev1 "k8s.io/api/core/v1"
+ "github.com/apache/camel-k/v2/pkg/client"
k8serrors "k8s.io/apimachinery/pkg/api/errors"
k8sclient "sigs.k8s.io/controller-runtime/pkg/client"
@@ -29,7 +29,7 @@ import (
)
// ApplyIntegrationProfile resolves integration profile from given object.
-func ApplyIntegrationProfile(ctx context.Context, c k8sclient.Reader, o
k8sclient.Object) (*v1.IntegrationProfile, error) {
+func ApplyIntegrationProfile(ctx context.Context, c client.Client, o
k8sclient.Object) (*v1.IntegrationProfile, error) {
profile, err := findIntegrationProfile(ctx, c, o)
if err != nil && !k8serrors.IsNotFound(err) {
return nil, err
@@ -41,7 +41,7 @@ func ApplyIntegrationProfile(ctx context.Context, c
k8sclient.Reader, o k8sclien
// findIntegrationProfile finds profile from given resource annotations
// and resolves the profile in given resource namespace, falling back to
// namespace annotation, "default" profile, or operator defaults.
-func findIntegrationProfile(ctx context.Context, c k8sclient.Reader, o
k8sclient.Object) (*v1.IntegrationProfile, error) {
+func findIntegrationProfile(ctx context.Context, c client.Client, o
k8sclient.Object) (*v1.IntegrationProfile, error) {
// 1. User provided profile (via annotation on the resource)
if profileResource := kubernetes.GetIntegrationProfileResource(o);
profileResource != "" {
return kubernetes.GetIntegrationProfile(ctx, c, profileResource)
@@ -51,13 +51,12 @@ func findIntegrationProfile(ctx context.Context, c
k8sclient.Reader, o k8sclient
// 2. Namespace annotated profile (via namespace annotation)
if namespace != "" {
- var ns corev1.Namespace
- err := c.Get(ctx, k8sclient.ObjectKey{Name: namespace}, &ns)
+ ns, err := kubernetes.LookupNamespace(ctx, c, namespace)
if err == nil {
- if profileName :=
v1.GetAnnotation(v1.IntegrationProfileAnnotation, &ns); profileName != "" {
+ if profileName :=
v1.GetAnnotation(v1.IntegrationProfileAnnotation, ns); profileName != "" {
return kubernetes.GetIntegrationProfile(ctx, c,
namespace+"/"+profileName)
}
- } else if !k8serrors.IsNotFound(err) &&
!k8serrors.IsForbidden(err) && !k8serrors.IsUnauthorized(err) {
+ } else if !k8serrors.IsNotFound(err) {
return nil, err
}
}
diff --git a/pkg/resources/config/rbac/descoped/operator-cluster-role.yaml
b/pkg/resources/config/rbac/descoped/operator-cluster-role.yaml
index 5b3dfe5f6..a21bef406 100644
--- a/pkg/resources/config/rbac/descoped/operator-cluster-role.yaml
+++ b/pkg/resources/config/rbac/descoped/operator-cluster-role.yaml
@@ -83,14 +83,6 @@ rules:
- get
- list
- watch
-- apiGroups:
- - ""
- resources:
- - namespaces
- verbs:
- - get
- - list
- - watch
- apiGroups:
- ""
resources:
diff --git a/pkg/resources/config/rbac/kustomization.yaml
b/pkg/resources/config/rbac/get-namespaces-cluster-role-binding.yaml
similarity index 71%
copy from pkg/resources/config/rbac/kustomization.yaml
copy to pkg/resources/config/rbac/get-namespaces-cluster-role-binding.yaml
index 629776651..badfd1205 100644
--- a/pkg/resources/config/rbac/kustomization.yaml
+++ b/pkg/resources/config/rbac/get-namespaces-cluster-role-binding.yaml
@@ -15,18 +15,16 @@
# limitations under the License.
# ---------------------------------------------------------------------------
-#
-# rbac resources applicable for all kubernetes platforms
-#
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-- builder-role.yaml
-- builder-role-openshift.yaml
-- dev-registry-role.yaml
-- kamelets-viewer-role.yaml
-- builder-role-binding.yaml
-- builder-role-binding-openshift.yaml
-- dev-registry-role-binding.yaml
-- kamelets-viewer-role-binding.yaml
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+ name: camel-k-operator-namespaces
+ labels:
+ app: "camel-k"
+subjects:
+- kind: ServiceAccount
+ name: camel-k-operator
+roleRef:
+ kind: ClusterRole
+ name: camel-k-operator-namespaces
+ apiGroup: rbac.authorization.k8s.io
diff --git a/pkg/resources/config/rbac/kustomization.yaml
b/pkg/resources/config/rbac/get-namespaces-cluster-role.yaml
similarity index 71%
copy from pkg/resources/config/rbac/kustomization.yaml
copy to pkg/resources/config/rbac/get-namespaces-cluster-role.yaml
index 629776651..d9a911370 100644
--- a/pkg/resources/config/rbac/kustomization.yaml
+++ b/pkg/resources/config/rbac/get-namespaces-cluster-role.yaml
@@ -15,18 +15,16 @@
# limitations under the License.
# ---------------------------------------------------------------------------
-#
-# rbac resources applicable for all kubernetes platforms
-#
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-- builder-role.yaml
-- builder-role-openshift.yaml
-- dev-registry-role.yaml
-- kamelets-viewer-role.yaml
-- builder-role-binding.yaml
-- builder-role-binding-openshift.yaml
-- dev-registry-role-binding.yaml
-- kamelets-viewer-role-binding.yaml
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+ name: camel-k-operator-namespaces
+ labels:
+ app: "camel-k"
+rules:
+- apiGroups:
+ - ""
+ resources:
+ - namespaces
+ verbs:
+ - get
diff --git a/pkg/resources/config/rbac/kustomization.yaml
b/pkg/resources/config/rbac/kustomization.yaml
index 629776651..9df92da16 100644
--- a/pkg/resources/config/rbac/kustomization.yaml
+++ b/pkg/resources/config/rbac/kustomization.yaml
@@ -30,3 +30,5 @@ resources:
- builder-role-binding-openshift.yaml
- dev-registry-role-binding.yaml
- kamelets-viewer-role-binding.yaml
+- get-namespaces-cluster-role.yaml
+- get-namespaces-cluster-role-binding.yaml
diff --git a/pkg/resources/config/rbac/namespaced/operator-role.yaml
b/pkg/resources/config/rbac/namespaced/operator-role.yaml
index 0511643fe..0999ba5b0 100644
--- a/pkg/resources/config/rbac/namespaced/operator-role.yaml
+++ b/pkg/resources/config/rbac/namespaced/operator-role.yaml
@@ -83,14 +83,6 @@ rules:
- get
- list
- watch
-- apiGroups:
- - ""
- resources:
- - namespaces
- verbs:
- - get
- - list
- - watch
- apiGroups:
- ""
resources:
diff --git a/pkg/util/kubernetes/lookup.go b/pkg/util/kubernetes/lookup.go
index 7e8f43ec8..a4b7097a9 100644
--- a/pkg/util/kubernetes/lookup.go
+++ b/pkg/util/kubernetes/lookup.go
@@ -229,3 +229,7 @@ func LookupService(ctx context.Context, c client.Client, ns
string, name string)
return &svc, nil
}
+
+func LookupNamespace(ctx context.Context, c client.Client, name string)
(*corev1.Namespace, error) {
+ return c.CoreV1().Namespaces().Get(ctx, name, metav1.GetOptions{})
+}
