Kuadrant / Kuadrant/authorino-operator
Possibility to watch AuthConfigs on a specified namespace
- Dominant language
- Go
- Stars
- 17
- Forks
- 32
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 10
Description
Authorino instances can either watch AuthConfigs in the same namespace where the instance is running (`namespaced` deployment mode) or in all namespaces (`cluster-wide` deployment mode).
Currently it is not possible to deploy an instance of Authorino in namespace X and make it watch for AuthConfigs defined in namespace Y (and no other namespace).
This is because, when the instance is not cluster-wide:
1. the value of the `WATCH_NAMESPACE` environment variable injected is set from the namespace of the `Authorino` CR https://github.com/Kuadrant/authorino-operator/blob/5ada185c42b88457843676e6e38c73c3708180dd/controllers/authorino_controller.go#L284
2. the RBAC created (`RoleBinding`) gives permission for the instance only in the namespace where it is running and no other https://github.com/Kuadrant/authorino-operator/blob/5ada185c42b88457843676e6e38c73c3708180dd/controllers/authorino_controller.go#L542
This makes cluster-wide deployment mode the only option for topologies where the Authorino instance is in one namespace and the AuthConfigs of interest in another. Label selectors might be needed to prevent the cluster-wide instance from caching AuthConfigs from other namespaces.
Contributor guide
Research direction
Start in controllers/authorino_controller.go at the WATCH_NAMESPACE handling around line 284 and RoleBinding creation around line 542. Determine how an Authorino instance can watch one specified namespace while retaining permissions only there, and whether label selectors are needed to exclude other namespaces. Done means an instance in namespace X watches AuthConfigs in namespace Y and no unrelated namespaces.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100