Skip to content

Commit

Permalink
kubeconfig: remove default namespace from crc-developer context
Browse files Browse the repository at this point in the history
the 'developer' user don't have the required role-bindings to access
the 'default' namespace and when user tries to access it we get:

```
Error from server (Forbidden): pods is forbidden: User "developer" cannot list resource "pods" in API group "" in the namespace "default"
```

fixes crc-org/snc#703
  • Loading branch information
anjannath committed Oct 28, 2024
1 parent 9b7772d commit 4c3310e
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 7 deletions.
8 changes: 4 additions & 4 deletions pkg/crc/machine/kubeconfig.go
Original file line number Diff line number Diff line change
Expand Up @@ -72,15 +72,15 @@ func writeKubeconfig(ip string, clusterConfig *types.ClusterConfig, ingressHTTPS
if err != nil {
return err
}
if err := addContext(cfg, clusterConfig.ClusterAPI, adminContext, "kubeadmin", kubeadminToken); err != nil {
if err := addContext(cfg, clusterConfig.ClusterAPI, adminContext, "kubeadmin", kubeadminToken, "default"); err != nil {
return err
}

developerToken, err := getTokenForUser("developer", "developer", ip, ca, clusterConfig, ingressHTTPSPort)
if err != nil {
return err
}
if err := addContext(cfg, clusterConfig.ClusterAPI, developerContext, "developer", developerToken); err != nil {
if err := addContext(cfg, clusterConfig.ClusterAPI, developerContext, "developer", developerToken, ""); err != nil {
return err
}

Expand Down Expand Up @@ -142,7 +142,7 @@ func hostname(clusterAPI string) (string, error) {
return strings.ReplaceAll(h, ".", "-"), nil
}

func addContext(cfg *api.Config, clusterAPI, context, username, token string) error {
func addContext(cfg *api.Config, clusterAPI, context, username, token, namespace string) error {
host, err := hostname(clusterAPI)
if err != nil {
return err
Expand All @@ -160,7 +160,7 @@ func addContext(cfg *api.Config, clusterAPI, context, username, token string) er
cfg.Contexts[context] = &api.Context{
Cluster: host,
AuthInfo: clusterUser,
Namespace: "default",
Namespace: namespace,
}
return nil
}
Expand Down
7 changes: 4 additions & 3 deletions pkg/crc/machine/kubeconfig_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -134,26 +134,27 @@ func Test_addContext(t *testing.T) {
username string
context string
token string
namespace string
}

tests := []struct {
in input
expected string
}{
{
input{"https://abcdd.api.com", "foo", "foo@abcdd", "secretToken"},
input{"https://abcdd.api.com", "foo", "foo@abcdd", "secretToken", "kube-system"},
"foo/abcdd-api-com",
},
{
input{"https://api.crc.testing:6443", "kubeadmin", "kubeadm", "secretToken"},
input{"https://api.crc.testing:6443", "kubeadmin", "kubeadm", "secretToken", "default"},
"kubeadmin/api-crc-testing:6443",
},
}

cfg := api.NewConfig()

for _, tt := range tests {
err := addContext(cfg, tt.in.clusterAPI, tt.in.context, tt.in.username, tt.in.token)
err := addContext(cfg, tt.in.clusterAPI, tt.in.context, tt.in.username, tt.in.token, tt.in.namespace)
assert.NoError(t, err)
assert.Contains(t, cfg.Contexts, tt.in.context, "Expected context not found")
assert.Contains(t, cfg.AuthInfos, tt.expected, "Expected AuthInfo not found")
Expand Down

0 comments on commit 4c3310e

Please sign in to comment.