fix: create release namespace under strict RBAC, --no-create-namespace flag - #662
Merged
Merged
Conversation
dmmordvi
changed the title
… permission Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
dmmordvi
force-pushed
the
fix/release-ns-creation-with-strict-rbac
branch
from
July 17, 2026 10:29
ac08366 to
7ef3170
Compare
dmmordvi
changed the title
Make createReleaseNamespace accept the kube.ClientFactorier interface so the release-namespace probe flow can be unit-tested with a recording fake, and add ai-tagged tests covering the full decision matrix: configmap probe success, configmap 403/404 falling back to namespace dry-run and real create, both probes 403/404 aggregating into the approved error, and non-403/404 errors (configmap probe, namespace probe, real create) propagating. Also reword the non-403/404 configmap probe error to reference the synchronization configmap instead of the release lock, since the probe is a generic namespace-access check and is not tied to release locking. Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
dmmordvi
changed the title
--no-create-namespace flag
ilya-lesikov
approved these changes
Jul 20, 2026
| "apiVersion": "v1", | ||
| "kind": "ConfigMap", | ||
| "metadata": map[string]interface{}{ | ||
| "name": "werf-synchronization", |
Member
There was a problem hiding this comment.
is there a constant? If not, create please in common package
| DryRun: true, | ||
| }); nsApplyErr != nil { | ||
| if errors.IsForbidden(nsApplyErr) || errors.IsNotFound(nsApplyErr) { | ||
| return fmt.Errorf("can't apply ConfigMap for locking, and can't apply release namespace (in case ConfigMap apply error caused by non-existent namespace):\n\n * %w\n * %w", cmApplyErr, nsApplyErr) |
Member
There was a problem hiding this comment.
I think we have Multierror somewhere for this, try it
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
alexey-igrychev
added a commit
that referenced
this pull request
Jul 28, 2026
* feat: add --lookup-resources flag for offline lookup in render/lint commands (#657) Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> (cherry picked from commit a984242) * fix: create release namespace under strict RBAC, `--no-create-namespace` flag (#662) Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> (cherry picked from commit 3d389ef) --------- Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> Co-authored-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.