Merge branch 'main' into ca-rotation-tests

OWNERS_ALIASES

@@ -14,10 +14,8 @@ aliases:
   - vyasgun
   docs-reviewers:
   - nainaz
-  - pmbanugo
   - retocode
   - skonto
-  - snneji
   docs-writers:
   - csantanapr
   - retocode
@@ -35,7 +33,6 @@ aliases:
   - creydr
   - lionelvillard
   - matzew
-  - odacremolbap
   - pierDipi
   func-reviewers:
   - jrangelramos

cmd/jobsink/main.go

@@ -297,12 +297,13 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	job.Labels[sinks.JobSinkIDLabel] = id
 	job.Labels[sinks.JobSinkNameLabel] = ref.Name
 	job.OwnerReferences = append(job.OwnerReferences, or)
-
+	var mountPathName string
 	for i := range job.Spec.Template.Spec.Containers {
 		found := false
 		for j := range job.Spec.Template.Spec.Containers[i].VolumeMounts {
 			if job.Spec.Template.Spec.Containers[i].VolumeMounts[j].Name == "jobsink-event" {
 				found = true
+				mountPathName = job.Spec.Template.Spec.Containers[i].VolumeMounts[j].MountPath
 				break
 			}
 		}
@@ -312,7 +313,12 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 				ReadOnly:  true,
 				MountPath: "/etc/jobsink-event",
 			})
+			mountPathName = "/etc/jobsink-event"
 		}
+		job.Spec.Template.Spec.Containers[i].Env = append(job.Spec.Template.Spec.Containers[i].Env, corev1.EnvVar{
+			Name:  "K_EVENT_PATH",
+			Value: mountPathName,
+		})
 	}
 
 	found := false

config/200-crossnamespace-clusterrole.yaml

@@ -0,0 +1 @@
+core/roles/crossnamespace-clusterrole.yaml

config/channels/in-memory-channel/roles/crossnamespace-clusterrole.yaml

@@ -0,0 +1,29 @@
+# Copyright 2024 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imc-subscriber
+  labels:
+    duck.knative.dev/crossnamespace-subscribable: "true"
+    app.kubernetes.io/version: devel
+    app.kubernetes.io/name: knative-eventing
+rules:
+- apiGroups:
+  - messaging.knative.dev
+  resources:
+  - inmemorychannels
+  verbs:
+  - knsubscribe

config/core/200-eventing-serviceaccount.yaml

@@ -110,3 +110,21 @@ roleRef:
   kind: ClusterRole
   name: channelable-manipulator
   apiGroup: rbac.authorization.k8s.io
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: eventing-controller-crossnamespace-subscriber
+  labels:
+    app.kubernetes.io/version: devel
+    app.kubernetes.io/name: knative-eventing
+subjects:
+  - kind: ServiceAccount
+    name: eventing-controller
+    namespace: knative-eventing
+roleRef:
+  kind: ClusterRole
+  name: crossnamespace-subscriber
+  apiGroup: rbac.authorization.k8s.io

config/core/roles/crossnamespace-clusterrole.yaml

@@ -0,0 +1,63 @@
+# Copyright 2024 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Use this aggregated ClusterRole when you need cluster wide crossnamespace subscribe permissions for all resources
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: crossnamespace-subscriber
+  labels:
+    app.kubernetes.io/version: devel
+    app.kubernetes.io/name: knative-eventing
+aggregationRule:
+  clusterRoleSelectors:
+  - matchLabels:
+      duck.knative.dev/crossnamespace-subscribable: "true"
+rules: [] # rules are automatically filled in by the controller manager.
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: channel-subscriber
+  labels:
+    duck.knative.dev/crossnamespace-subscribable: "true"
+    app.kubernetes.io/version: devel
+    app.kubernetes.io/name: knative-eventing
+rules:
+- apiGroups:
+  - messaging.knative.dev
+  resources:
+  - channels
+  verbs:
+  - knsubscribe
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: broker-subscriber
+  labels:
+    duck.knative.dev/crossnamespace-subscribable: "true"
+    app.kubernetes.io/version: devel
+    app.kubernetes.io/name: knative-eventing
+rules:
+- apiGroups:
+  - eventing.knative.dev
+  resources:
+  - brokers
+  verbs:
+  - knsubscribe