fix(auth): fix role binding management namespace handling

Author: froz42

internal/services/auth/auth.service.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/danielgtaylor/huma/v2"
 	envsvc "github.com/froz42/kerbernetes/internal/services/env"
+	k8ssvc "github.com/froz42/kerbernetes/internal/services/k8s"
 	ldapgroupbindingssvc "github.com/froz42/kerbernetes/internal/services/k8s/ldapgroupbindings"
 	k8smodels "github.com/froz42/kerbernetes/internal/services/k8s/models"
 	serviceaccountssvc "github.com/froz42/kerbernetes/internal/services/k8s/serviceaccounts"
@@ -22,6 +23,7 @@ type AuthService interface {
 
 type authService struct {
 	env                  envsvc.Env
+	k8sSvc               k8ssvc.K8sService
 	serviceAccountsSvc   serviceaccountssvc.ServiceAccountsService
 	ldapGroupBindingsSvc ldapgroupbindingssvc.LdapGroupBindingService
 	ldapSvc              ldapsvc.LDAPSvc
@@ -378,6 +380,8 @@ func (s *authService) ensureRoleBinding(
 		Name:     binding.Name,
 	}
 
+	saNamespace := s.k8sSvc.GetNamespace()
+
 	if !exists {
 		newBinding, err := s.serviceAccountsSvc.CreateRoleBinding(
 			ctx,
@@ -402,7 +406,19 @@ func (s *authService) ensureRoleBinding(
 			"bindingName", newBinding.Name,
 		)
 	} else {
-		if existing.RoleRef.Name != binding.Name ||
+		subjectDiffer := false
+		if len(existing.Subjects) != 1 {
+			subjectDiffer = true
+		} else {
+			subject := existing.Subjects[0]
+			if subject.Kind != "ServiceAccount" ||
+				subject.Name != saName ||
+				subject.Namespace != saNamespace {
+				subjectDiffer = true
+			}
+		}
+		if subjectDiffer ||
+			existing.RoleRef.Name != binding.Name ||
 			existing.RoleRef.Kind != binding.Kind ||
 			existing.RoleRef.APIGroup != binding.ApiGroup {
 			_, err := s.serviceAccountsSvc.UpdateRoleBinding(

internal/services/k8s/serviceaccounts/serviceaccounts.service.go

@@ -317,11 +317,12 @@ func (svc *serviceAccountsService) GetRoleBindings(
 func (svc *serviceAccountsService) CreateRoleBinding(
 	ctx context.Context,
 	username string,
-	namespace string,
+	roleBindingNamespace string,
 	ldapGroundBindingName string,
 	roleRef rbacv1.RoleRef,
 ) (*rbacv1.RoleBinding, error) {
 	name := GenBindingName(username, roleRef.Name, ldapGroundBindingName)
+	saNamespace := svc.namespace
 	binding := &rbacv1.RoleBinding{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: name,
@@ -333,51 +334,74 @@ func (svc *serviceAccountsService) CreateRoleBinding(
 			{
 				Kind:      "ServiceAccount",
 				Name:      username,
-				Namespace: namespace,
+				Namespace: saNamespace,
 			},
 		},
 		RoleRef: roleRef,
 	}
 
 	binding, err := svc.clientset.RbacV1().
-		RoleBindings(namespace).
+		RoleBindings(roleBindingNamespace).
 		Create(ctx, binding, metav1.CreateOptions{})
 	if err != nil {
 		svc.logger.Error("Failed to create role binding", "error", err)
 		return nil, err
 	}
 
-	svc.logger.Info("Created role binding", "name", binding.Name, "namespace", namespace)
+	svc.logger.Info(
+		"Created role binding",
+		"name",
+		binding.Name,
+		"roleBindingNamespace",
+		roleBindingNamespace,
+		"saNamespace",
+		saNamespace,
+	)
 	return binding, nil
 }
 
 // UpdateRoleBinding updates an existing role binding for the service account.
 func (svc *serviceAccountsService) UpdateRoleBinding(
 	ctx context.Context,
 	username string,
-	namespace string,
+	roleBindingNamespace string,
 	roleRef rbacv1.RoleRef,
 	ldapGroundBindingName string,
 ) (*rbacv1.RoleBinding, error) {
 	name := GenBindingName(username, roleRef.Name, ldapGroundBindingName)
 	binding, err := svc.clientset.RbacV1().
-		RoleBindings(namespace).
+		RoleBindings(roleBindingNamespace).
 		Get(ctx, name, metav1.GetOptions{})
 	if err != nil {
 		svc.logger.Error("Failed to get role binding", "error", err)
 		return nil, err
 	}
 
 	binding.RoleRef = roleRef
+	binding.Subjects = []rbacv1.Subject{
+		{
+			Kind:      "ServiceAccount",
+			Name:      username,
+			Namespace: svc.namespace,
+		},
+	}
 	binding, err = svc.clientset.RbacV1().
-		RoleBindings(namespace).
+		RoleBindings(roleBindingNamespace).
 		Update(ctx, binding, metav1.UpdateOptions{})
 	if err != nil {
 		svc.logger.Error("Failed to update role binding", "error", err)
 		return nil, err
 	}
 
-	svc.logger.Info("Updated role binding", "name", binding.Name, "namespace", namespace)
+	svc.logger.Info(
+		"Updated role binding",
+		"name",
+		binding.Name,
+		"roleBindingNamespace",
+		roleBindingNamespace,
+		"saNamespace",
+		svc.namespace,
+	)
 	return binding, nil
 }