layer1: fix sa namespace routing step 2

pkg/utils/namespace_test.go

@@ -262,6 +262,37 @@ func TestNamespaceResolver(t *testing.T) {
 	})
 }
 
+func TestServiceAccountResolveSANamespace(t *testing.T) {
+	sa := &ServiceAccount{
+		nsResolver: &NamespaceResolver{
+			FunctionNamespace: "fission-function",
+			BuilderNamespace:  "fission-builder",
+			DefaultNamespace:  "default",
+		},
+	}
+
+	t.Run("fetcher uses function namespace for default ns", func(t *testing.T) {
+		resolvedNS := sa.resolveSANamespace("default", FetcherSAName)
+		if resolvedNS != "fission-function" {
+			t.Fatalf("expected function namespace, got %s", resolvedNS)
+		}
+	})
+
+	t.Run("builder uses builder namespace for default ns", func(t *testing.T) {
+		resolvedNS := sa.resolveSANamespace("default", BuilderSAName)
+		if resolvedNS != "fission-builder" {
+			t.Fatalf("expected builder namespace, got %s", resolvedNS)
+		}
+	})
+
+	t.Run("builder keeps tenant namespace unchanged", func(t *testing.T) {
+		resolvedNS := sa.resolveSANamespace("tenant-a", BuilderSAName)
+		if resolvedNS != "tenant-a" {
+			t.Fatalf("expected tenant namespace, got %s", resolvedNS)
+		}
+	})
+}
+
 func getFissionNamespaces(builderNS, functionNS, defaultNS string) *NamespaceResolver {
 	return &NamespaceResolver{
 		FunctionNamespace: functionNS,