SnehaNprog opened a new pull request, #6953:
URL: https://github.com/apache/camel-k/pull/6953
Fixes #6952
Problem
StorageClass is cluster-scoped, so the `storageclasses` rule in the
namespaced
operator Role never granted anything. In single-namespace installs the mount
trait's StorageClass lookup is forbidden.
Fix
Same approach as 2653b794a (namespaces): the rule is removed from the
namespaced Role and the descoped ClusterRole (kustomize and Helm) and shipped
as a dedicated ClusterRole + ClusterRoleBinding in the common RBAC, so it
applies to all install modes.
Security note
This grants every install mode read-only (get, list) cluster-wide access to
StorageClasses. No write access is added.
Testing
- New unit test in pkg/resources (fails without the fix, passes with it)
- kustomize: single-namespace, own-namespace, all-namespaces overlays render
the new ClusterRole/Binding
- helm: operator.global=false and true render it
- kind cluster: `kubectl auth can-i list storageclasses` as the operator SA
went from "no" (main) to "yes" (this branch); `delete` stays "no"
- make lint: 0 issues
- go test ./...: all pass except pkg/builder,
pkg/controller/integrationplatform
and pkg/util/camel, which need `mvn`, not installed on my machine
- E2E suites not run locally
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
