CamelK 1.9.2 when installed via OLM "system:serviceaccount:openshift-operators:camel-k-operator" cannot get resource "channels" in API group "messaging.knative.dev"

[maschmid]

On OpenShift, installing current Serverless Operator 1.22.1 and current Camel K Operator 1.9.2 via OLM.

Following the knative example https://github.com/apache/camel-k/tree/v1.9.2/examples/knative

fails

Cannot reconcile Integration printer: error during trait customization: error looking up channel words: channels.messaging.knative.dev "words" is forbidden: User "system:serviceaccount:openshift-operators:camel-k-operator" cannot get resource "channels" in API group "messaging.knative.dev" in the namespace "foobar"

Steps to reproduce:

• On OpenShift, install Serverless Operator via OLM, create default KnativeServing and KnativeEventing in knative-serving, knative-eventing namespaces respectively
• Install Camel K Operator 1.9.2 via OLM (default stable-1.9 channel)
• create a foobar namespace
• Follow the example

kubectl create -f messages-channel.yaml
kubectl create -f words-channel.yaml
kamel run printer.groovy

[squakez]

It seems a privilege problem. I think you should try to manually add the proper permission for the camel-k-operator service account. As the channel resource is in a namespace where the operator is not installed, I think there is not any possibility to include such permission by default during the installation (even more considering that you create the namespace after installing the camel k operator).

[maschmid]

The same scenario works fine with the Camel K Operator version 1.8.2 , so it is a regression.

[maschmid]

See also #2958 , which added the binding to the addressable-resolver ClusterRole in 1.8, which is what is supposed to grant the permissions for any Addressable.