Feat: Emit Events on the controller Pod instead of cluster-scoped Bundle

[asmaoune]

Summary

trust-manager currently records Kubernetes Events against the cluster-scoped Bundle resource. Because the involved object is cluster-scoped, Events are created in the default namespace (as per Kubernetes guidance). With the new trust-manager feature add ability to limit the target namespaces managed, the controller may not have permissions to write Events in default. This leads to Event creation failures/noise. I propose switching to emitting Events on the trust-manager Pod (namespaced) so Event writes always happen in the operator’s own namespace where it has RBAC.

Problem

• Today: Events for Bundle actions are emitted with involvedObject=Bundle/..., stored in the default namespace
• In restricted environments using the target-namespaces feature, trust-manager may not have create permissions for Events in default (and default may not be in the targetlist at all)
• Result: Event writes fail, causing warning logs and loss of operational signals, or requiring broader-than-necessary RBAC in default

Proposed change

Emit Events against the trust-manager Pod (namespaced), ensuring:

• Events are created in the same namespace where trust-manager runs (and where it already has RBAC)

[asmaoune]

@erikgb any news about this issue

[erikgb]

I think events from cluster scoped resources are created in the default namespace. Your setup appears a bit "special".

[asmaoune]

@erikgb Yes, I agree but when trust manager is limited to a list of namespaces and the default namespace is not in the target-namespaces, in this case it will fail to write events in the default namespace

[erikgb]

But the events come from a cluster scoped resource. So some elevated access is needed anyway. Grant RBAC to create events in the default namespace appears like the right thing to do here.

[asmaoune]

And if we disable events creation when trust-manager is limited to a liste of namespaces, is it ok ?

[erikgb]

I personally don't see disabling events a useful thing, as it disables an important observability feature. And if it were to be implemented, we should NOT tie it to the target namespaces feature.

[asmaoune]

ok thanks