@@ -108,8 +108,8 @@ const (
108108 sveltosApplierOverrideAnnotation = "sveltosapplier.projectsveltos.io/config-override-ref"
109109)
110110
111- func getSveltosAgentNamespace () string {
112- return projectsveltos
111+ func getSveltosAgentNamespace (sveltosNamespace string ) string {
112+ return sveltosNamespace
113113}
114114
115115func (r * ClassifierReconciler ) deployClassifier (ctx context.Context , classifierScope * scope.ClassifierScope ,
@@ -374,10 +374,10 @@ func getKubeconfigFromAccessRequest(ctx context.Context, c client.Client, cluste
374374
375375func createSecretNamespace (ctx context.Context , c client.Client ) error {
376376 ns := & corev1.Namespace {}
377- err := c .Get (ctx , types.NamespacedName {Name : libsveltosv1beta1 . ClassifierSecretNamespace }, ns )
377+ err := c .Get (ctx , types.NamespacedName {Name : getSveltosNamespace () }, ns )
378378 if err != nil {
379379 if apierrors .IsNotFound (err ) {
380- ns .Name = libsveltosv1beta1 . ClassifierSecretNamespace
380+ ns .Name = getSveltosNamespace ()
381381 return c .Create (ctx , ns )
382382 }
383383 return err
@@ -406,14 +406,14 @@ func updateSecretWithAccessManagementKubeconfig(ctx context.Context, c client.Cl
406406
407407 secret := & corev1.Secret {}
408408 key := client.ObjectKey {
409- Namespace : libsveltosv1beta1 . ClassifierSecretNamespace ,
409+ Namespace : getSveltosNamespace () ,
410410 Name : libsveltosv1beta1 .ClassifierSecretName ,
411411 }
412412
413413 dataKey := "kubeconfig"
414414 err = remoteClient .Get (ctx , key , secret )
415415 if err != nil {
416- secret .Namespace = libsveltosv1beta1 . ClassifierSecretNamespace
416+ secret .Namespace = getSveltosNamespace ()
417417 secret .Name = libsveltosv1beta1 .ClassifierSecretName
418418 secret .Data = map [string ][]byte {
419419 dataKey : kubeconfig ,
@@ -1553,7 +1553,7 @@ func createSveltosAgentNamespaceInManagedCluster(ctx context.Context, c client.C
15531553
15541554 ns := & corev1.Namespace {
15551555 ObjectMeta : metav1.ObjectMeta {
1556- Name : getSveltosAgentNamespace (),
1556+ Name : getSveltosAgentNamespace (getSveltosNamespace () ),
15571557 },
15581558 }
15591559
@@ -1671,6 +1671,40 @@ func deploySveltosAgentInManagementCluster(ctx context.Context, restConfig *rest
16711671 restConfig , agentYAML , lbls , patches , false , logger )
16721672}
16731673
1674+ // updateResourceNamespace sets the namespace on a resource that requires it.
1675+ // For namespaced resources the object metadata namespace is updated.
1676+ // For ClusterRoleBinding the subjects are also patched: the resource is cluster-scoped so
1677+ // GetNamespace() returns "" and the plain SetNamespace call would not reach it, but each
1678+ // ServiceAccount subject still carries an explicit namespace that must match the actual
1679+ // location of the ServiceAccount.
1680+ func updateResourceNamespace (policy * unstructured.Unstructured , namespace string ) error {
1681+ if policy .GetNamespace () != "" {
1682+ policy .SetNamespace (namespace )
1683+ }
1684+
1685+ if policy .GetKind () != "ClusterRoleBinding" {
1686+ return nil
1687+ }
1688+
1689+ subjects , found , err := unstructured .NestedSlice (policy .Object , "subjects" )
1690+ if err != nil || ! found {
1691+ return err
1692+ }
1693+
1694+ for i := range subjects {
1695+ subject , ok := subjects [i ].(map [string ]interface {})
1696+ if ! ok {
1697+ continue
1698+ }
1699+ if subject ["kind" ] == "ServiceAccount" {
1700+ subject ["namespace" ] = namespace
1701+ subjects [i ] = subject
1702+ }
1703+ }
1704+
1705+ return unstructured .SetNestedSlice (policy .Object , subjects , "subjects" )
1706+ }
1707+
16741708func deploySveltosAgentResources (ctx context.Context , clusterNamespace , clusterName , classifierName string ,
16751709 restConfig * rest.Config , agentYAML string , lbls map [string ]string , patches []libsveltosv1beta1.Patch ,
16761710 isPullMode bool , logger logr.Logger ) error {
@@ -1710,6 +1744,11 @@ func deploySveltosAgentResources(ctx context.Context, clusterNamespace, clusterN
17101744 }
17111745 }
17121746
1747+ if err := updateResourceNamespace (policy , getSveltosNamespace ()); err != nil {
1748+ logger .V (logs .LogInfo ).Error (err , "failed to update resource namespace" )
1749+ return err
1750+ }
1751+
17131752 var referencedUnstructured []* unstructured.Unstructured
17141753 if len (patches ) > 0 {
17151754 logger .V (logs .LogInfo ).Info ("Patch sveltos-agent resources" )
@@ -1765,6 +1804,11 @@ func deploySveltosApplierResources(ctx context.Context, clusterNamespace, cluste
17651804 return err
17661805 }
17671806
1807+ if err := updateResourceNamespace (policy , getSveltosNamespace ()); err != nil {
1808+ logger .V (logs .LogInfo ).Error (err , "failed to update resource namespace" )
1809+ return err
1810+ }
1811+
17681812 var referencedUnstructured []* unstructured.Unstructured
17691813 if len (patches ) > 0 {
17701814 logger .V (logs .LogDebug ).Info ("Patch sveltos-applier resources" )
@@ -1851,7 +1895,8 @@ func getSveltosAgentDeploymentName(ctx context.Context, restConfig *rest.Config,
18511895 }
18521896
18531897 // using client and a List would require permission at cluster level. So using clientset instead
1854- deployments , err := clientset .AppsV1 ().Deployments (getSveltosAgentNamespace ()).List (ctx , listOptions )
1898+ deployments , err := clientset .AppsV1 ().Deployments (getSveltosAgentNamespace (getSveltosNamespace ())).
1899+ List (ctx , listOptions )
18551900 if err != nil {
18561901 return "" , err
18571902 }
@@ -1930,6 +1975,10 @@ func removeSveltosAgentFromManagementCluster(ctx context.Context,
19301975 return err
19311976 }
19321977
1978+ if policy .GetNamespace () != "" {
1979+ policy .SetNamespace (getSveltosNamespace ())
1980+ }
1981+
19331982 dr , err := k8s_utils .GetDynamicResourceInterface (restConfig , policy .GroupVersionKind (), policy .GetNamespace ())
19341983 if err != nil {
19351984 logger .V (logs .LogInfo ).Error (err , "failed to get dynamic client" )
@@ -2028,7 +2077,7 @@ func getSveltosAgentPatchesOld(ctx context.Context, c client.Client,
20282077 configMap := & corev1.ConfigMap {}
20292078 if configMapName != "" {
20302079 err := c .Get (ctx ,
2031- types.NamespacedName {Namespace : projectsveltos , Name : configMapName },
2080+ types.NamespacedName {Namespace : getSveltosNamespace () , Name : configMapName },
20322081 configMap )
20332082 if err != nil {
20342083 logger .V (logs .LogInfo ).Info (fmt .Sprintf ("failed to get ConfigMap %s: %v" ,
@@ -2060,7 +2109,7 @@ func getSveltosApplierPatchesOld(ctx context.Context, c client.Client,
20602109 configMap := & corev1.ConfigMap {}
20612110 if configMapName != "" {
20622111 err := c .Get (ctx ,
2063- types.NamespacedName {Namespace : projectsveltos , Name : configMapName },
2112+ types.NamespacedName {Namespace : getSveltosNamespace () , Name : configMapName },
20642113 configMap )
20652114 if err != nil {
20662115 logger .V (logs .LogInfo ).Info (fmt .Sprintf ("failed to get ConfigMap %s: %v" ,
@@ -2098,7 +2147,7 @@ func getSveltosAgentPatches(ctx context.Context, c client.Client,
20982147 }
20992148
21002149 configMapName := getSveltosAgentConfigMap ()
2101- patches , err = getSveltosAgentPatchesNew (ctx , c , projectsveltos , configMapName , logger )
2150+ patches , err = getSveltosAgentPatchesNew (ctx , c , getSveltosNamespace () , configMapName , logger )
21022151 if err == nil {
21032152 return patches , nil
21042153 }
@@ -2120,7 +2169,7 @@ func getSveltosApplierPatches(ctx context.Context, c client.Client,
21202169 }
21212170
21222171 configMapName := getSveltosApplierConfigMap ()
2123- patches , err = getSveltosApplierPatchesNew (ctx , c , projectsveltos , configMapName , logger )
2172+ patches , err = getSveltosApplierPatchesNew (ctx , c , getSveltosNamespace () , configMapName , logger )
21242173 if err == nil {
21252174 return patches , nil
21262175 }
0 commit comments