Add decorator to remove namespace from ClusterRole and ClusterRoleBinding

Author: mcruzdev

extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/KubernetesCommonHelper.java

@@ -291,6 +291,11 @@ private static Collection<DecoratorBuildItem> createRbacDecorators(String name,
             List<KubernetesEffectiveServiceAccountBuildItem> effectiveServiceAccounts,
             List<KubernetesRoleBindingBuildItem> roleBindingsFromExtensions) {
         List<DecoratorBuildItem> result = new ArrayList<>();
+
+        // Cluster resources does not have namespace
+        result.add(new DecoratorBuildItem(target, new RemoveNamespaceFromClusterRoleBindingDecorator()));
+        result.add(new DecoratorBuildItem(target, new RemoveNamespaceFromClusterRoleDecorator()));
+
         boolean kubernetesClientRequiresRbacGeneration = kubernetesClientConfiguration
                 .map(KubernetesClientCapabilityBuildItem::isGenerateRbac).orElse(false);
         Set<String> roles = new HashSet<>();

extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/RemoveNamespaceFromClusterRoleBindingDecorator.java

@@ -0,0 +1,28 @@
+package io.quarkus.kubernetes.deployment;
+
+import io.dekorate.kubernetes.decorator.Decorator;
+import io.dekorate.kubernetes.decorator.NamedResourceDecorator;
+import io.fabric8.kubernetes.api.model.ObjectMeta;
+import io.fabric8.kubernetes.api.model.rbac.ClusterRoleBindingBuilder;
+
+/**
+ * Decorator responsible for remove namespace from ClusterRoleBinding resource.
+ *
+ * This decorator executes after {@link AddNamespaceDecorator}.
+ */
+public class RemoveNamespaceFromClusterRoleBindingDecorator extends NamedResourceDecorator<ClusterRoleBindingBuilder> {
+
+    @Override
+    public void andThenVisit(ClusterRoleBindingBuilder clusterRoleBindingBuilder, ObjectMeta objectMeta) {
+        clusterRoleBindingBuilder
+                .withNewMetadata()
+                .withNamespace(null)
+                .withName(objectMeta.getName())
+                .endMetadata();
+    }
+
+    @Override
+    public Class<? extends Decorator>[] after() {
+        return new Class[] { AddNamespaceDecorator.class };
+    }
+}

extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/RemoveNamespaceFromClusterRoleDecorator.java

@@ -0,0 +1,28 @@
+package io.quarkus.kubernetes.deployment;
+
+import io.dekorate.kubernetes.decorator.Decorator;
+import io.dekorate.kubernetes.decorator.NamedResourceDecorator;
+import io.fabric8.kubernetes.api.model.ObjectMeta;
+import io.fabric8.kubernetes.api.model.rbac.ClusterRoleBuilder;
+
+/**
+ * Decorator responsible for remove namespace from ClusterRole resource.
+ *
+ * This decorator executes after {@link AddNamespaceDecorator}.
+ */
+public class RemoveNamespaceFromClusterRoleDecorator extends NamedResourceDecorator<ClusterRoleBuilder> {
+
+    @Override
+    public void andThenVisit(ClusterRoleBuilder clusterRoleBuilder, ObjectMeta objectMeta) {
+        clusterRoleBuilder
+                .withNewMetadata()
+                .withNamespace(null)
+                .withName(objectMeta.getName())
+                .endMetadata();
+    }
+
+    @Override
+    public Class<? extends Decorator>[] after() {
+        return new Class[] { AddNamespaceDecorator.class };
+    }
+}

integration-tests/kubernetes/quarkus-standard-way/src/test/java/io/quarkus/it/kubernetes/KubernetesWithRbacFullTest.java

@@ -84,6 +84,7 @@ public void assertGeneratedResources() throws IOException {
 
         // secret-reader assertions
         ClusterRole secretReaderRole = getClusterRoleByName(kubernetesList, "secret-reader");
+        assertThat(secretReaderRole.getMetadata().getNamespace()).isEqualTo(null);
         assertThat(secretReaderRole.getRules()).satisfiesOnlyOnce(r -> {
             assertThat(r.getApiGroups()).containsExactly("");
             assertThat(r.getResources()).containsExactly("secrets");
@@ -111,6 +112,7 @@ public void assertGeneratedResources() throws IOException {
         assertEquals("Group", clusterSubject.getKind());
         assertEquals("manager", clusterSubject.getName());
         assertEquals("rbac.authorization.k8s.io", clusterSubject.getApiGroup());
+        assertThat(clusterRoleBinding.getMetadata().getNamespace()).isEqualTo(null);
     }
 
     private int lastIndexOfKind(String content, String... kinds) {