You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by GitBox <gi...@apache.org> on 2022/06/27 18:40:45 UTC

[GitHub] [camel-k] christophd opened a new pull request, #3400: fix(#3390): Fix Knative addressable resolver cluster role binding

christophd opened a new pull request, #3400:
URL: https://github.com/apache/camel-k/pull/3400

   Use proper operator namespace in the service account role binding subject for global operators. Was using empty global operator watch namespace which caused errors in the cluster role binding.
   
   Fixes #3390 
   Fixes #3328 
   
   **Release Note**
   ```release-note
   Fix(Knative): Cluster role binding for Knative addressable resolver. Bring back permissions for messaging.knative.dev resources (e.g. channel)
   ```
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


[GitHub] [camel-k] christophd commented on a diff in pull request #3400: fix(#3390): Fix Knative addressable resolver cluster role binding

Posted by GitBox <gi...@apache.org>.
christophd commented on code in PR #3400:
URL: https://github.com/apache/camel-k/pull/3400#discussion_r910756598


##########
pkg/install/knative.go:
##########
@@ -32,45 +32,45 @@ import (
 
 const knativeAddressableResolverClusterRoleName = "addressable-resolver"
 
-// BindKnativeAddressableResolverClusterRole binds the Knative Addressable resolver aggregated ClusterRole
+// BindKnativeAddressableResolverClusterRole binds the Knative addressable resolver aggregated ClusterRole
 // to the operator ServiceAccount.
-func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, global bool, operatorNamespace string) error {
 	if isKnative, err := knative.IsInstalled(ctx, c); err != nil {
 		return err
 	} else if !isKnative {
 		return nil
 	}
-	if namespace != "" {
-		return applyAddressableResolverRoleBinding(ctx, c, namespace)
+	if global {
+		return applyAddressableResolverClusterRoleBinding(ctx, c, operatorNamespace)
 	}
-	return applyAddressableResolverClusterRoleBinding(ctx, c, namespace)
+	return applyAddressableResolverRoleBinding(ctx, c, operatorNamespace)
 }
 
-func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string) error {
-	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), namespace).
+func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, operatorNamespace string) error {
+	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), operatorNamespace).

Review Comment:
   @astefanutti I reverted to using both WATCH_NAMESPACE and operatorNamespace as an argument. Please have a final look. Many thanks



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


[GitHub] [camel-k] christophd commented on a diff in pull request #3400: fix(#3390): Fix Knative addressable resolver cluster role binding

Posted by GitBox <gi...@apache.org>.
christophd commented on code in PR #3400:
URL: https://github.com/apache/camel-k/pull/3400#discussion_r907712622


##########
pkg/install/knative.go:
##########
@@ -32,26 +32,26 @@ import (
 
 const knativeAddressableResolverClusterRoleName = "addressable-resolver"
 
-// BindKnativeAddressableResolverClusterRole binds the Knative Addressable resolver aggregated ClusterRole
+// BindKnativeAddressableResolverClusterRole binds the Knative addressable resolver aggregated ClusterRole
 // to the operator ServiceAccount.
-func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string, operatorNamespace string) error {
 	if isKnative, err := knative.IsInstalled(ctx, c); err != nil {
 		return err
 	} else if !isKnative {
 		return nil
 	}
 	if namespace != "" {
-		return applyAddressableResolverRoleBinding(ctx, c, namespace)
+		return applyAddressableResolverRoleBinding(ctx, c, namespace, operatorNamespace)
 	}
-	return applyAddressableResolverClusterRoleBinding(ctx, c, namespace)
+	return applyAddressableResolverClusterRoleBinding(ctx, c, operatorNamespace)
 }
 
-func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string, operatorNamespace string) error {
 	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), namespace).

Review Comment:
   so I could remove the operator namespace argument from the func again and just use namespace. or the other way round



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


[GitHub] [camel-k] christophd commented on a diff in pull request #3400: fix(#3390): Fix Knative addressable resolver cluster role binding

Posted by GitBox <gi...@apache.org>.
christophd commented on code in PR #3400:
URL: https://github.com/apache/camel-k/pull/3400#discussion_r907711822


##########
pkg/install/knative.go:
##########
@@ -32,26 +32,26 @@ import (
 
 const knativeAddressableResolverClusterRoleName = "addressable-resolver"
 
-// BindKnativeAddressableResolverClusterRole binds the Knative Addressable resolver aggregated ClusterRole
+// BindKnativeAddressableResolverClusterRole binds the Knative addressable resolver aggregated ClusterRole
 // to the operator ServiceAccount.
-func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string, operatorNamespace string) error {
 	if isKnative, err := knative.IsInstalled(ctx, c); err != nil {
 		return err
 	} else if !isKnative {
 		return nil
 	}
 	if namespace != "" {
-		return applyAddressableResolverRoleBinding(ctx, c, namespace)
+		return applyAddressableResolverRoleBinding(ctx, c, namespace, operatorNamespace)
 	}
-	return applyAddressableResolverClusterRoleBinding(ctx, c, namespace)
+	return applyAddressableResolverClusterRoleBinding(ctx, c, operatorNamespace)
 }
 
-func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string, operatorNamespace string) error {
 	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), namespace).

Review Comment:
   this is the local operator case where WATCH_NAMESPACE is not empty. In this case operator namespace and WATCH_NAMESPACE tend to be the same anyways isn't it?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


[GitHub] [camel-k] oscerd merged pull request #3400: fix(#3390): Fix Knative addressable resolver cluster role binding

Posted by GitBox <gi...@apache.org>.
oscerd merged PR #3400:
URL: https://github.com/apache/camel-k/pull/3400


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


[GitHub] [camel-k] astefanutti commented on a diff in pull request #3400: fix(#3390): Fix Knative addressable resolver cluster role binding

Posted by GitBox <gi...@apache.org>.
astefanutti commented on code in PR #3400:
URL: https://github.com/apache/camel-k/pull/3400#discussion_r910725733


##########
pkg/install/knative.go:
##########
@@ -32,45 +32,45 @@ import (
 
 const knativeAddressableResolverClusterRoleName = "addressable-resolver"
 
-// BindKnativeAddressableResolverClusterRole binds the Knative Addressable resolver aggregated ClusterRole
+// BindKnativeAddressableResolverClusterRole binds the Knative addressable resolver aggregated ClusterRole
 // to the operator ServiceAccount.
-func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, global bool, operatorNamespace string) error {
 	if isKnative, err := knative.IsInstalled(ctx, c); err != nil {
 		return err
 	} else if !isKnative {
 		return nil
 	}
-	if namespace != "" {
-		return applyAddressableResolverRoleBinding(ctx, c, namespace)
+	if global {
+		return applyAddressableResolverClusterRoleBinding(ctx, c, operatorNamespace)
 	}
-	return applyAddressableResolverClusterRoleBinding(ctx, c, namespace)
+	return applyAddressableResolverRoleBinding(ctx, c, operatorNamespace)
 }
 
-func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string) error {
-	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), namespace).
+func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, operatorNamespace string) error {
+	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), operatorNamespace).

Review Comment:
   I think that's possible with OLM `SingleNamespace` installation mode that we support. The leader Lease is for making there is a single operator replica being active, it's not meant to be locking a namespace, even if it may have been diverted for that purpose :)



##########
pkg/install/knative.go:
##########
@@ -32,45 +32,45 @@ import (
 
 const knativeAddressableResolverClusterRoleName = "addressable-resolver"
 
-// BindKnativeAddressableResolverClusterRole binds the Knative Addressable resolver aggregated ClusterRole
+// BindKnativeAddressableResolverClusterRole binds the Knative addressable resolver aggregated ClusterRole
 // to the operator ServiceAccount.
-func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, global bool, operatorNamespace string) error {
 	if isKnative, err := knative.IsInstalled(ctx, c); err != nil {
 		return err
 	} else if !isKnative {
 		return nil
 	}
-	if namespace != "" {
-		return applyAddressableResolverRoleBinding(ctx, c, namespace)
+	if global {
+		return applyAddressableResolverClusterRoleBinding(ctx, c, operatorNamespace)
 	}
-	return applyAddressableResolverClusterRoleBinding(ctx, c, namespace)
+	return applyAddressableResolverRoleBinding(ctx, c, operatorNamespace)
 }
 
-func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string) error {
-	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), namespace).
+func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, operatorNamespace string) error {
+	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), operatorNamespace).

Review Comment:
   I think that's possible with OLM `SingleNamespace` installation mode that we support. The leader Lease is for making sure there is a single operator replica being active, it's not meant to be locking a namespace, even if it may have been diverted for that purpose :)



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


[GitHub] [camel-k] christophd commented on pull request #3400: fix(#3390): Fix Knative addressable resolver cluster role binding

Posted by GitBox <gi...@apache.org>.
christophd commented on PR #3400:
URL: https://github.com/apache/camel-k/pull/3400#issuecomment-1168315926

   @astefanutti could you please have another look. I am now only using the operatorNamespace passing in the globalOperator boolean flag to see if we need to set as cluster role or normal role binding. This way we avoid having two namespaces (WATCH_NAMESPACE and operatorNamespace) in the funcs and it will be less confusing 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


[GitHub] [camel-k] astefanutti commented on a diff in pull request #3400: fix(#3390): Fix Knative addressable resolver cluster role binding

Posted by GitBox <gi...@apache.org>.
astefanutti commented on code in PR #3400:
URL: https://github.com/apache/camel-k/pull/3400#discussion_r910699865


##########
pkg/install/knative.go:
##########
@@ -32,45 +32,45 @@ import (
 
 const knativeAddressableResolverClusterRoleName = "addressable-resolver"
 
-// BindKnativeAddressableResolverClusterRole binds the Knative Addressable resolver aggregated ClusterRole
+// BindKnativeAddressableResolverClusterRole binds the Knative addressable resolver aggregated ClusterRole
 // to the operator ServiceAccount.
-func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, global bool, operatorNamespace string) error {
 	if isKnative, err := knative.IsInstalled(ctx, c); err != nil {
 		return err
 	} else if !isKnative {
 		return nil
 	}
-	if namespace != "" {
-		return applyAddressableResolverRoleBinding(ctx, c, namespace)
+	if global {
+		return applyAddressableResolverClusterRoleBinding(ctx, c, operatorNamespace)
 	}
-	return applyAddressableResolverClusterRoleBinding(ctx, c, namespace)
+	return applyAddressableResolverRoleBinding(ctx, c, operatorNamespace)
 }
 
-func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string) error {
-	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), namespace).
+func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, operatorNamespace string) error {
+	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), operatorNamespace).

Review Comment:
   I realise I may have introduced the confusion in the first place, but I'm not sure this is going to work when the WATCH_NAMESPACE is different from the operator namespace. Is it? If not, we'll have to keep the WATCH_NAMESPACE argument.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


[GitHub] [camel-k] astefanutti commented on a diff in pull request #3400: fix(#3390): Fix Knative addressable resolver cluster role binding

Posted by GitBox <gi...@apache.org>.
astefanutti commented on code in PR #3400:
URL: https://github.com/apache/camel-k/pull/3400#discussion_r907696537


##########
pkg/install/knative.go:
##########
@@ -32,26 +32,26 @@ import (
 
 const knativeAddressableResolverClusterRoleName = "addressable-resolver"
 
-// BindKnativeAddressableResolverClusterRole binds the Knative Addressable resolver aggregated ClusterRole
+// BindKnativeAddressableResolverClusterRole binds the Knative addressable resolver aggregated ClusterRole
 // to the operator ServiceAccount.
-func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string, operatorNamespace string) error {
 	if isKnative, err := knative.IsInstalled(ctx, c); err != nil {
 		return err
 	} else if !isKnative {
 		return nil
 	}
 	if namespace != "" {
-		return applyAddressableResolverRoleBinding(ctx, c, namespace)
+		return applyAddressableResolverRoleBinding(ctx, c, namespace, operatorNamespace)
 	}
-	return applyAddressableResolverClusterRoleBinding(ctx, c, namespace)
+	return applyAddressableResolverClusterRoleBinding(ctx, c, operatorNamespace)
 }
 
-func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string, operatorNamespace string) error {
 	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), namespace).

Review Comment:
   Should that be `operatorNamespace` here as well?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


[GitHub] [camel-k] astefanutti commented on a diff in pull request #3400: fix(#3390): Fix Knative addressable resolver cluster role binding

Posted by GitBox <gi...@apache.org>.
astefanutti commented on code in PR #3400:
URL: https://github.com/apache/camel-k/pull/3400#discussion_r910725733


##########
pkg/install/knative.go:
##########
@@ -32,45 +32,45 @@ import (
 
 const knativeAddressableResolverClusterRoleName = "addressable-resolver"
 
-// BindKnativeAddressableResolverClusterRole binds the Knative Addressable resolver aggregated ClusterRole
+// BindKnativeAddressableResolverClusterRole binds the Knative addressable resolver aggregated ClusterRole
 // to the operator ServiceAccount.
-func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, global bool, operatorNamespace string) error {
 	if isKnative, err := knative.IsInstalled(ctx, c); err != nil {
 		return err
 	} else if !isKnative {
 		return nil
 	}
-	if namespace != "" {
-		return applyAddressableResolverRoleBinding(ctx, c, namespace)
+	if global {
+		return applyAddressableResolverClusterRoleBinding(ctx, c, operatorNamespace)
 	}
-	return applyAddressableResolverClusterRoleBinding(ctx, c, namespace)
+	return applyAddressableResolverRoleBinding(ctx, c, operatorNamespace)
 }
 
-func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string) error {
-	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), namespace).
+func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, operatorNamespace string) error {
+	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), operatorNamespace).

Review Comment:
   I think that's possible with OLM `SingleNamespace` installation mode that we support. The leader Lease if for making there is a single operator replica being active, it's not meant to be locking a namespace, even if it may have been diverted for that purpose :)



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


[GitHub] [camel-k] christophd commented on a diff in pull request #3400: fix(#3390): Fix Knative addressable resolver cluster role binding

Posted by GitBox <gi...@apache.org>.
christophd commented on code in PR #3400:
URL: https://github.com/apache/camel-k/pull/3400#discussion_r910714729


##########
pkg/install/knative.go:
##########
@@ -32,45 +32,45 @@ import (
 
 const knativeAddressableResolverClusterRoleName = "addressable-resolver"
 
-// BindKnativeAddressableResolverClusterRole binds the Knative Addressable resolver aggregated ClusterRole
+// BindKnativeAddressableResolverClusterRole binds the Knative addressable resolver aggregated ClusterRole
 // to the operator ServiceAccount.
-func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, global bool, operatorNamespace string) error {
 	if isKnative, err := knative.IsInstalled(ctx, c); err != nil {
 		return err
 	} else if !isKnative {
 		return nil
 	}
-	if namespace != "" {
-		return applyAddressableResolverRoleBinding(ctx, c, namespace)
+	if global {
+		return applyAddressableResolverClusterRoleBinding(ctx, c, operatorNamespace)
 	}
-	return applyAddressableResolverClusterRoleBinding(ctx, c, namespace)
+	return applyAddressableResolverRoleBinding(ctx, c, operatorNamespace)
 }
 
-func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string) error {
-	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), namespace).
+func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, operatorNamespace string) error {
+	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), operatorNamespace).

Review Comment:
   This may be a really rare edge case where a local operator is watching another foreign namespace. Not sure of this construct where WATCH_NAMESPACE and operator namespace are different even works. In fact the operator leader lease is then missing in this foreign namespace and other operators may also reconcile resources because of this.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


[GitHub] [camel-k] christophd commented on a diff in pull request #3400: fix(#3390): Fix Knative addressable resolver cluster role binding

Posted by GitBox <gi...@apache.org>.
christophd commented on code in PR #3400:
URL: https://github.com/apache/camel-k/pull/3400#discussion_r910730579


##########
pkg/install/knative.go:
##########
@@ -32,45 +32,45 @@ import (
 
 const knativeAddressableResolverClusterRoleName = "addressable-resolver"
 
-// BindKnativeAddressableResolverClusterRole binds the Knative Addressable resolver aggregated ClusterRole
+// BindKnativeAddressableResolverClusterRole binds the Knative addressable resolver aggregated ClusterRole
 // to the operator ServiceAccount.
-func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, namespace string) error {
+func BindKnativeAddressableResolverClusterRole(ctx context.Context, c kubernetes.Interface, global bool, operatorNamespace string) error {
 	if isKnative, err := knative.IsInstalled(ctx, c); err != nil {
 		return err
 	} else if !isKnative {
 		return nil
 	}
-	if namespace != "" {
-		return applyAddressableResolverRoleBinding(ctx, c, namespace)
+	if global {
+		return applyAddressableResolverClusterRoleBinding(ctx, c, operatorNamespace)
 	}
-	return applyAddressableResolverClusterRoleBinding(ctx, c, namespace)
+	return applyAddressableResolverRoleBinding(ctx, c, operatorNamespace)
 }
 
-func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, namespace string) error {
-	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), namespace).
+func applyAddressableResolverRoleBinding(ctx context.Context, c kubernetes.Interface, operatorNamespace string) error {
+	rb := rbacv1ac.RoleBinding(fmt.Sprintf("%s-addressable-resolver", serviceAccountName), operatorNamespace).

Review Comment:
   ok, I am fine bringing back the two arguments



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org