lsergio opened a new pull request, #6798:
URL: https://github.com/apache/camel-k/pull/6798
### Motivation
Fixes #6797
The camel-k-operator pod and the builder Pods created by the `pod` build
strategy have no use for Kubernetes' Docker-links-style service env
injection (`{SVC}_SERVICE_HOST` / `{SVC}_SERVICE_PORT` per Service in
the namespace). In a namespace with a high Service count, this env
injection can push a container's combined args+env past the kernel's
`ARG_MAX` / `MAX_ARG_STRLEN`, causing it to fail to even start with
`exec ...: argument list too long`.
This is the same E2BIG failure mode that #6724 / #6725 addressed for
user Integrations, by adding an opt-in `enableServiceLinks` field to the
(deprecated) Integration pod template. Integration pods are user-facing,
so that fix made the behavior configurable rather than changing the
default.
The operator pod and builder pods are purely internal to camel-k and
never rely on service-link env injection, so there's no tradeoff in
setting `enableServiceLinks: false` unconditionally for both, rather
than requiring an operator-deployer to opt in.
### What this does
- Sets `enableServiceLinks: false` on the operator Deployment's pod spec
in `pkg/resources/config/manager/operator-deployment.yaml` (the
canonical manifest; `install/base/config` is a symlink to
`pkg/resources/config`, so the Kustomize install picks this up too)
and in the Helm chart's own copy,
`helm/camel-k/templates/operator-deployment.yaml`.
- Sets `EnableServiceLinks: ptr.To(false)` on the builder Pod's
`corev1.PodSpec` built in `newBuildPod`
(`pkg/controller/build/build_pod.go`).
### Testing
- Extended `TestNewBuildPodConfiguration` in `build_pod_test.go` to
assert `pod.Spec.EnableServiceLinks` is non-nil and `false`.
- `go build ./pkg/controller/build/...` and the extended unit test pass.
- No test added for the two YAML manifests themselves — the repo has no
existing test harness parsing/asserting fields on the operator
Deployment manifest (no Helm unittest setup, no Go test loading
`operator-deployment.yaml`), so adding one felt disproportionate for a
single field.
### Suggested reviewers
- @squakez (Pasquale Congiusti) — by far the most active recent
committer across all three touched files/areas (operator manifest,
Helm chart, builder pod).
- @oscerd (Andrea Cosentino) — authored the project's threat model and
SECURITY.md; this change follows the threat model's operator
hardening guidance (reducing the operator/builder pod's default
attack surface), so flagging for input on that framing.
---
_This change was prepared by Claude Code on behalf of Luis Sergio Carneiro
(@lsergio)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
