Skip to content

fix(control-plane): use project kube client for namespace provisioner #1175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
markturansky merged 1 commit into from
Apr 2, 2026
Merged

fix(control-plane): use project kube client for namespace provisioner #1175

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion components/ambient-control-plane/cmd/ambient-control-plane/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,11 @@ func runKubeMode(ctx context.Context, cfg *config.ControlPlaneConfig) error {
log.Info().Str("token_file", cfg.ProjectKubeTokenFile).Msg("using separate project kube client")
}

provisioner := buildNamespaceProvisioner(cfg, kube)
provisionerKube := kube
if projectKube != nil {
provisionerKube = projectKube
}
provisioner := buildNamespaceProvisioner(cfg, provisionerKube)
Comment on lines +116 to +120

@coderabbitai coderabbitai Bot Apr 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Unconditional projectKube override can break standard namespace provisioning

At Line 117, the provisioner client switches to projectKube whenever it exists, regardless of cfg.PlatformMode. Since this client is then stored and used for namespace CRUD by both provisioners, standard mode can fail with Forbidden if the project token is narrower than the main kube client.

Suggested fix 
-	provisionerKube := kube
-	if projectKube != nil {
-		provisionerKube = projectKube
-	}
+	provisionerKube := kube
+	if cfg.PlatformMode == "mpp" && projectKube != nil {
+		provisionerKube = projectKube
+	}
 	provisioner := buildNamespaceProvisioner(cfg, provisionerKube)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
provisionerKube := kube
if projectKube != nil {
provisionerKube = projectKube
}
provisioner := buildNamespaceProvisioner(cfg, provisionerKube)
provisionerKube := kube
if cfg.PlatformMode == "mpp" && projectKube != nil {
provisionerKube = projectKube
}
provisioner := buildNamespaceProvisioner(cfg, provisionerKube)
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@components/ambient-control-plane/cmd/ambient-control-plane/main.go` around
lines 116 - 120, The current logic unconditionally swaps provisionerKube to
projectKube when projectKube != nil, which causes namespace CRUD to use a
potentially restricted token and fail in standard mode; update the selection so
provisionerKube uses projectKube only when cfg.PlatformMode indicates
project-scoped operation (e.g., check cfg.PlatformMode == "project" or
equivalent), otherwise keep using kube; adjust the call site that constructs the
provisioner via buildNamespaceProvisioner to pass the correctly chosen
provisionerKube.

tokenProvider := buildTokenProvider(cfg, log.Logger)

factory := reconciler.NewSDKClientFactory(cfg.APIServerURL, tokenProvider, log.Logger)
Expand Down
Loading