layer1: fix sa namespace routing step 2

pkg/utils/namespace_test.go

@@ -262,6 +262,37 @@ func TestNamespaceResolver(t *testing.T) {
 	})
 }
 
+func TestServiceAccountResolveSANamespace(t *testing.T) {
+	sa := &ServiceAccount{
+		nsResolver: &NamespaceResolver{
+			FunctionNamespace: "fission-function",
+			BuilderNamespace:  "fission-builder",
+			DefaultNamespace:  "default",
+		},
+	}
+
+	t.Run("fetcher uses function namespace for default ns", func(t *testing.T) {
+		resolvedNS := sa.resolveSANamespace("default", FetcherSAName)
+		if resolvedNS != "fission-function" {
+			t.Fatalf("expected function namespace, got %s", resolvedNS)
+		}
+	})
+
+	t.Run("builder uses builder namespace for default ns", func(t *testing.T) {
+		resolvedNS := sa.resolveSANamespace("default", BuilderSAName)
+		if resolvedNS != "fission-builder" {
+			t.Fatalf("expected builder namespace, got %s", resolvedNS)
+		}
+	})
+
+	t.Run("builder keeps tenant namespace unchanged", func(t *testing.T) {
+		resolvedNS := sa.resolveSANamespace("tenant-a", BuilderSAName)
+		if resolvedNS != "tenant-a" {
+			t.Fatalf("expected tenant namespace, got %s", resolvedNS)
+		}
+	})
+}
+
 func getFissionNamespaces(builderNS, functionNS, defaultNS string) *NamespaceResolver {
 	return &NamespaceResolver{
 		FunctionNamespace: functionNS,

pkg/utils/serviceaccount.go

@@ -118,18 +118,22 @@ func getSAObj(kubernetesClient kubernetes.Interface, logger *zap.Logger) *Servic
 }
 
 func (sa *ServiceAccount) runSACheck(ctx context.Context) {
-	for _, ns := range sa.nsResolver.FissionResourceNS {
+	for _, baseNS := range sa.nsResolver.Snapshot() {
 		for _, permission := range sa.permissions {
-			if permission.saName == BuilderSAName {
-				ns = sa.nsResolver.GetBuilderNS(ns)
-			} else {
-				ns = sa.nsResolver.GetFunctionNS(ns)
-			}
-			setupSAAndRoleBindings(ctx, sa.kubernetesClient, sa.logger, ns, permission)
+			targetNS := sa.resolveSANamespace(baseNS, permission.saName)
+			setupSAAndRoleBindings(ctx, sa.kubernetesClient, sa.logger, targetNS, permission)
 		}
 	}
 }
 
+func (sa *ServiceAccount) resolveSANamespace(baseNS, saName string) string {
+	if saName == BuilderSAName {
+		return sa.nsResolver.GetBuilderNS(baseNS)
+	}
+
+	return sa.nsResolver.GetFunctionNS(baseNS)
+}
+
 func setupSAAndRoleBindings(ctx context.Context, client kubernetes.Interface, logger *zap.Logger, namespace string, ps *ServiceAccountPermissions) {
 	SAObj, err := createGetSA(ctx, client, ps.saName, namespace)
 	if err != nil {