Fix namespaced mode

cmd/main.go

@@ -30,6 +30,7 @@ import (
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/certwatcher"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
@@ -186,7 +187,8 @@ func main() {
 		})
 	}
 
-	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
+	// Configure manager options
+	managerOptions := ctrl.Options{
 		Scheme:                 scheme,
 		Metrics:                metricsServerOptions,
 		WebhookServer:          webhookServer,
@@ -204,7 +206,19 @@ func main() {
 		// if you are doing or is intended to do any operation such as perform cleanups
 		// after the manager stops then its usage might be unsafe.
 		// LeaderElectionReleaseOnCancel: true,
-	})
+	}
+
+	// Check if we should use namespace-scoped caching based on environment variable
+	// This should be set when using namespace-scoped RBAC (Role instead of ClusterRole)
+	if useNamespaceCache := os.Getenv("USE_NAMESPACE_CACHE"); useNamespaceCache == "true" {
+		setupLog.Info("Using namespace-scoped cache for enhanced security", "namespace", targetNamespace)
+		// Limit the cache to only watch the target namespace
+		managerOptions.Cache.DefaultNamespaces = map[string]cache.Config{
+			targetNamespace: {},
+		}
+	}
+
+	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), managerOptions)
 	if err != nil {
 		setupLog.Error(err, "unable to start manager")
 		os.Exit(1)

config/default/kustomization.yaml

@@ -1,5 +1,5 @@
 # Adds namespace to all resources.
-namespace: dapr-trustbundle-system
+namespace: dapr-system
 
 # Value of this field is prepended to the
 # names of all resources, e.g. a deployment named

config/manager/kustomization.yaml

@@ -4,5 +4,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 images:
 - name: controller
-  newName: example.com/dapr-trustbundle
-  newTag: v0.0.1
+  newName: dapr-trustbundle-operator
+  newTag: latest

deploy/helm/dapr-trustbundle/templates/deployment.yaml

@@ -40,8 +40,12 @@ spec:
         {{- end }}
         - --source-secret-name={{ .Values.controller.sourceSecretName }}
         - --target-namespace={{ .Values.controller.targetNamespace }}
-        {{- with .Values.env }}
         env:
+        {{- if not .Values.rbac.useClusterRole }}
+        - name: USE_NAMESPACE_CACHE
+          value: "true"
+        {{- end }}
+        {{- with .Values.env }}
           {{- toYaml . | nindent 10 }}
         {{- end }}
         ports:

deploy/helm/dapr-trustbundle/values.yaml

@@ -103,7 +103,7 @@ rbac:
   # Use cluster-wide permissions (ClusterRole) or namespace-scoped permissions (Role)
   # Only applicable when rbac.create is true
   # Set to false for namespace-scoped permissions when operator only monitors one namespace
-  useClusterRole: true
+  useClusterRole: false
   # Additional RBAC rules can be added here
   additionalRules: []
 

examples/certificate.yaml

@@ -10,7 +10,6 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: dapr-sentry-root-ca
-  namespace: dapr-system
 spec:
   secretName: dapr-sentry-root-ca
   commonName: dapr-sentry-root-ca-from-cert-manager

examples/test-secret.yaml

@@ -2,7 +2,6 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: dapr-trust-bundle-from-cert-manager
-  namespace: dapr-system
 type: kubernetes.io/tls
 data:
   ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJvRENDQVVhZ0F3SUJBZ0lRUjNFV09oZitUOHRCbHBRbTFLWDVnREFLQmdncWhrak9QUVFEQWpBd01TNHcKTEFZRFZRUURFeVZrWVhCeUxYTmxiblJ5ZVMxeWIyOTBMV05oTFdaeWIyMHRZMlZ5ZEMxdFlXNWhaMlZ5TUI0WApEVEkxTURnd09ERXlNemN6TWxvWERUTXdNRGd3TnpFeU16Y3pNbG93TURFdU1Dd0dBMVVFQXhNbFpHRndjaTF6ClpXNTBjbmt0Y205dmRDMWpZUzFtY205dExXTmxjblF0YldGdVlXZGxjakJaTUJNR0J5cUdTTTQ5QWdFR0NDcUcKU000OUF3RUhBMElBQlBTb3JORjBYKzNpZ09YNFBuOHZ5dWxOeC9NeU5ZWlZFcU9UV01IVlJUZFFnVDRYWXc2UApINldER1RCK2oxVlVKVC9mOFFLSWxNMUR1WWVKV2lPNklUU2pRakJBTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXQkJSMDBlUHliVTFUY2w5UU9rYStuQXRtbG5jcVBqQUsKQmdncWhrak9QUVFEQWdOSUFEQkZBaUVBL2FieG0rQ2EyZlN1OElrSHJmY2F6UUFLSTVwaS83L3RkYU9zb3lWWQo3V1lDSURWWXFKKzBFcXB6TTZ1S3UvNysybmcwN01qc0NhSEFQeXllYmZhOFhRR04KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=

test/e2e/e2e_test.go

@@ -31,7 +31,7 @@ import (
 )
 
 // namespace where the project is deployed in
-const namespace = "dapr-trustbundle-system"
+const namespace = "dapr-system"
 
 // serviceAccountName created for the project
 const serviceAccountName = "dapr-trustbundle-operator"