AllanAlmeida commented on code in PR #6822:
URL: https://github.com/apache/camel-k/pull/6822#discussion_r4072670690
##########
pkg/trait/kamelets.go:
##########
@@ -202,33 +202,40 @@ func (t *kameletsTrait) collectKamelets(e *Environment)
(map[string]*v1.Kamelet,
// calculateNamespaces is in charge to scan the kamelets specification and
provide a list of
// namespaces where to look for Kamelets.
func (t *kameletsTrait) calculateNamespaces(e *Environment, defaultNamespaces
...string) ([]string, error) {
- namespaces, err := calculateNamespaces(strings.Split(t.List, ","))
+ kamelets := strings.Split(t.List, ",")
+ namespaces, err := calculateNamespaces(kamelets)
if err != nil {
return namespaces, err
}
- if len(namespaces) > 0 {
- if e.Integration.Spec.ServiceAccountName == "" {
- return nil, errors.New("you must to use an authorized
ServiceAccount to access cross-namespace resources kamelets. " +
- "Set it in the Integration spec accordingly")
+ if len(namespaces) > 0 && e.Integration.Spec.ServiceAccountName == "" {
+ return nil, errors.New("you must to use an authorized
ServiceAccount to access cross-namespace resources kamelets. " +
+ "Set it in the Integration spec accordingly")
+ }
+ // verify an SA exists and it is authorized for each Kamelet
+ for _, kml := range kamelets {
+ ns, err := getKameletNamespace(kml)
+ if err != nil {
+ return nil, fmt.Errorf("could not parse kamelet
namespace: %w", err)
}
- // verify an SA exists and it is authorized for Kamelets in
that namespace
- for _, ns := range namespaces {
- ok, err := kubernetes.CheckServiceAccountPermission(
- e.Ctx,
- e.Client,
- fmt.Sprintf("system:serviceaccount:%s:%s",
e.Integration.Namespace, e.Integration.Spec.ServiceAccountName),
- v1.SchemeGroupVersion.Group,
- "kamelets",
- ns,
- "get",
- )
- if err != nil {
- return nil, err
- }
- if !ok {
- return nil, fmt.Errorf("cross-namespace
Integration reference authorization denied for the ServiceAccount %s and
resources kamelets",
- e.Integration.Spec.ServiceAccountName)
- }
+ if ns == "" {
+ continue
+ }
+ ok, err := kubernetes.CheckServiceAccountPermission(
+ e.Ctx,
+ e.Client,
+ fmt.Sprintf("system:serviceaccount:%s:%s",
e.Integration.Namespace, e.Integration.Spec.ServiceAccountName),
+ v1.SchemeGroupVersion.Group,
+ "kamelets",
+ ns,
+ getKameletKey(kml),
+ "get",
+ )
+ if err != nil {
+ return nil, err
+ }
+ if !ok {
+ return nil, fmt.Errorf("cross-namespace Integration
reference authorization denied for the ServiceAccount %s and resources
kamelets",
Review Comment:
Addressed in 94622bf4a: the authorization error now includes the denied
Kamelet name and namespace, with assertions for both a generic unauthorized
service account and a resource-specific denial. I also expanded coverage for
invalid references and SubjectAccessReview error paths.
_AI-generated by Codex on behalf of Allan Almeida._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
