Kuadrant / Kuadrant/authorino-operator

Possibility to watch AuthConfigs on a specified namespace

Open
#36 0 comments 0 reactions 0 assignees View on GitHub
area/api area/implementation kind/enhancement participation/good first issue size/small
Dominant language
Go
Stars
17
Forks
32
Avg merge
2d 20h
Merged PRs (30d)
10

Description

Authorino instances can either watch AuthConfigs in the same namespace where the instance is running (`namespaced` deployment mode) or in all namespaces (`cluster-wide` deployment mode).

Currently it is not possible to deploy an instance of Authorino in namespace X and make it watch for AuthConfigs defined in namespace Y (and no other namespace).

This is because, when the instance is not cluster-wide:
1. the value of the `WATCH_NAMESPACE` environment variable injected is set from the namespace of the `Authorino` CR https://github.com/Kuadrant/authorino-operator/blob/5ada185c42b88457843676e6e38c73c3708180dd/controllers/authorino_controller.go#L284
2. the RBAC created (`RoleBinding`) gives permission for the instance only in the namespace where it is running and no other https://github.com/Kuadrant/authorino-operator/blob/5ada185c42b88457843676e6e38c73c3708180dd/controllers/authorino_controller.go#L542

This makes cluster-wide deployment mode the only option for topologies where the Authorino instance is in one namespace and the AuthConfigs of interest in another. Label selectors might be needed to prevent the cluster-wide instance from caching AuthConfigs from other namespaces.

Contributor guide

Open the contributing guide

Research direction

Start in controllers/authorino_controller.go at the WATCH_NAMESPACE handling around line 284 and RoleBinding creation around line 542. Determine how an Authorino instance can watch one specified namespace while retaining permissions only there, and whether label selectors are needed to exclude other namespaces. Done means an instance in namespace X watches AuthConfigs in namespace Y and no unrelated namespaces.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.