multi-tenant: EnsureNamespaceSA + ns_watcher SA provisioning (v8)

pkg/utils/namespace.go

@@ -3,6 +3,7 @@ package utils
 import (
 	"os"
 	"strings"
+	"sync"
 
 	"go.uber.org/zap"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -19,6 +20,8 @@ const (
 
 type (
 	NamespaceResolver struct {
+		mu sync.RWMutex // protects FissionResourceNS
+
 		FunctionNamespace string
 		BuilderNamespace  string
 		DefaultNamespace  string
@@ -82,16 +85,33 @@ func WithDefaultNs() option {
 	}
 }
 
+// AddNamespace dynamically adds a namespace to FissionResourceNS without restarting the process.
+// Returns true if the namespace was newly added, false if it was already present.
+// Thread-safe — multiple goroutines may call this concurrently.
+// The label fission.io/managed=true on the Namespace object is the trigger for this call.
+func (nsr *NamespaceResolver) AddNamespace(ns string) bool {
+	nsr.mu.Lock()
+	defer nsr.mu.Unlock()
+	if _, exists := nsr.FissionResourceNS[ns]; exists {
+		return false
+	}
+	nsr.FissionResourceNS[ns] = ns
+	nsr.Logger.Info("dynamically added namespace to resolver", zap.String("namespace", ns))
+	return true
+}
+
 func (nsr *NamespaceResolver) FissionNSWithOptions(option ...option) map[string]string {
 	var options options
 	for _, opt := range option {
 		options = *opt(&options)
 	}
 
-	fissionResourceNS := make(map[string]string)
+	nsr.mu.RLock()
+	fissionResourceNS := make(map[string]string, len(nsr.FissionResourceNS))
 	for k, v := range nsr.FissionResourceNS {
 		fissionResourceNS[k] = v
 	}
+	nsr.mu.RUnlock()
 
 	if options.functionNS && nsr.FunctionNamespace != "" {
 		fissionResourceNS[nsr.FunctionNamespace] = nsr.FunctionNamespace

pkg/utils/serviceaccount.go

@@ -308,3 +308,10 @@ func getSAInterval() time.Duration {
 	SAInterval, _ := GetUIntValueFromEnv(ENV_SA_INTERVAL)
 	return time.Duration(SAInterval) * time.Minute
 }
+
+// EnsureNamespaceSA creates the fission-fetcher ServiceAccount and its Role/RoleBinding
+// in the given namespace if they do not already exist. Safe to call repeatedly.
+// Used by the multi-tenant NS watcher to provision per-namespace SA on NS registration.
+func EnsureNamespaceSA(ctx context.Context, client kubernetes.Interface, logger *zap.Logger, ns string) {
+setupSAAndRoleBindings(ctx, client, logger, ns, fetcherCheck)
+}