feat(builder): dependencies privileges

docs/modules/ROOT/pages/installation/installation.adoc

@@ -14,10 +14,11 @@ The first step is to install and run the Camel K operator. You can do it via any
 https://kustomize.io[Kustomize] provides a declarative approach to the configuration customization of a Camel-K installation. Kustomize works either with a standalone executable or as a built-in to `kubectl`. The https://github.com/apache/camel-k/tree/main/install[/install] directory provides a series of base and overlays configuration that you can use. You can create your own overlays or customize the one available in the repository to accommodate your need.
 
 ```
+$ kubectl create ns camel-k
 $ kubectl apply -k github.com/apache/camel-k/install/overlays/kubernetes/descoped?ref=v2.4.0 --server-side
 ```
 
-You can specify as `ref` parameter the version you're willing to install (ie, `v2.4.0`). The command above will install a descoped (global) operator in the camel-k namespace.
+You can specify as `ref` parameter the version you're willing to install (ie, `v2.4.0`). The command above will install a descoped (global) operator in the camel-k namespace. This is the suggested configuration in order to manage Integrations in all namespaces.
 
 [[helm]]
 === Installation via Helm Hub

pkg/builder/image.go

@@ -160,7 +160,7 @@ func imageContext(ctx *builderContext, selector artifactsSelector) error {
 
 	contextDir := filepath.Join(ctx.Path, ContextDir)
 
-	err = os.MkdirAll(contextDir, io.FilePerm700)
+	err = os.MkdirAll(contextDir, io.FilePerm755)
 	if err != nil {
 		return err
 	}

pkg/builder/jib.go

@@ -156,6 +156,7 @@ func buildJibMavenArgs(mavenDir, image, baseImage string, insecureRegistry bool,
 	mavenArgs = append(mavenArgs, jib.JibMavenToImageParam+image)
 	mavenArgs = append(mavenArgs, jib.JibMavenFromImageParam+baseImage)
 	mavenArgs = append(mavenArgs, jib.JibMavenBaseImageCache+mavenDir+"/jib")
+	mavenArgs = append(mavenArgs, "-Djib.container.user=1000")
 
 	if imagePlatforms != nil {
 		platforms := strings.Join(imagePlatforms, ",")

pkg/builder/jib_test.go

@@ -42,7 +42,7 @@ func TestJibBuildMavenArgs(t *testing.T) {
 	require.NoError(t, err)
 	expectedParams := strings.Split(
 		fmt.Sprintf("jib:build -Djib.disableUpdateChecks=true -x some-maven-option -P jib -Djib.to.image=my-image "+
-			"-Djib.from.image=my-base-image -Djib.baseImageCache=%s -Djib.allowInsecureRegistries=true", tmpMvnCtxDir+"/jib"),
+			"-Djib.from.image=my-base-image -Djib.baseImageCache=%s -Djib.container.user=1000 -Djib.allowInsecureRegistries=true", tmpMvnCtxDir+"/jib"),
 		" ")
 	assert.Equal(t, expectedParams, args)
 }
@@ -55,7 +55,7 @@ func TestJibBuildMavenArgsWithPlatforms(t *testing.T) {
 	require.NoError(t, err)
 	expectedParams := strings.Split(
 		fmt.Sprintf("jib:build -Djib.disableUpdateChecks=true -x some-maven-option -P jib -Djib.to.image=my-image "+
-			"-Djib.from.image=my-base-image -Djib.baseImageCache=%s -Djib.from.platforms=amd64,arm64 -Djib.allowInsecureRegistries=true",
+			"-Djib.from.image=my-base-image -Djib.baseImageCache=%s -Djib.container.user=1000 -Djib.from.platforms=amd64,arm64 -Djib.allowInsecureRegistries=true",
 			tmpMvnCtxDir+"/jib"),
 		" ")
 	assert.Equal(t, expectedParams, args)

pkg/controller/integrationplatform/kamelets.go

@@ -61,7 +61,7 @@ func installKameletCatalog(ctx context.Context, c client.Client, platform *v1.In
 		return -1, -1, err
 	}
 	// Download Kamelet dependency
-	if err := downloadKameletDependency(ctx, version, kameletDir); err != nil {
+	if err := downloadKameletDependency(ctx, platform, version, kameletDir); err != nil {
 		return -1, -1, err
 	}
 	// Extract Kamelets files
@@ -100,11 +100,13 @@ func prepareKameletDirectory() (string, error) {
 	return kameletDir, nil
 }
 
-func downloadKameletDependency(ctx context.Context, version, kameletsDir string) error {
+func downloadKameletDependency(ctx context.Context, platform *v1.IntegrationPlatform, version, kameletsDir string) error {
 	// TODO: we may want to add the maven settings coming from the platform
 	// in order to cover any user security setting in place
 	p := maven.NewProjectWithGAV("org.apache.camel.k.kamelets", "kamelets-catalog", defaults.Version)
 	mc := maven.NewContext(kameletsDir)
+	mc.LocalRepository = platform.Status.Build.Maven.LocalRepository
+	mc.AdditionalArguments = platform.Status.Build.Maven.CLIOptions
 	mc.AddArgument("-q")
 	mc.AddArgument("dependency:copy")
 	mc.AddArgument(fmt.Sprintf("-Dartifact=org.apache.camel.kamelets:camel-kamelets:%s:jar", version))

pkg/controller/integrationplatform/kamelets_test.go

@@ -112,6 +112,7 @@ func TestPrepareKameletsDirectory(t *testing.T) {
 }
 
 func TestDownloadKameletDependencyAndExtract(t *testing.T) {
+	itp := v1.NewIntegrationPlatform("itp-ns", "my-itp")
 	// use local Maven executable in tests
 	t.Setenv("MAVEN_WRAPPER", boolean.FalseString)
 	_, ok := os.LookupEnv("MAVEN_CMD")
@@ -126,7 +127,7 @@ func TestDownloadKameletDependencyAndExtract(t *testing.T) {
 	assert.NoError(t, err)
 	camelVersion := c.Runtime.Metadata["camel.version"]
 	assert.NotEqual(t, "", camelVersion)
-	err = downloadKameletDependency(context.TODO(), camelVersion, tmpDir)
+	err = downloadKameletDependency(context.TODO(), &itp, camelVersion, tmpDir)
 	assert.NoError(t, err)
 	downloadedDependency, err := os.Stat(path.Join(tmpDir, fmt.Sprintf("camel-kamelets-%s.jar", camelVersion)))
 	assert.NoError(t, err)

pkg/install/operator.go

@@ -467,13 +467,13 @@ func installClusterRoleBinding(ctx context.Context, c client.Client, collection
 func installOpenShiftRoles(ctx context.Context, c client.Client, namespace string, customizer ResourceCustomizer, collection *kubernetes.Collection, force bool, global bool) error {
 	if global {
 		return ResourcesOrCollect(ctx, c, namespace, collection, force, customizer,
-			"/config/rbac/openshift/descoped/operator-cluster-role-openshift.yaml",
-			"/config/rbac/openshift/descoped/operator-cluster-role-binding-openshift.yaml",
+			"/config/rbac/descoped/operator-cluster-role-openshift.yaml",
+			"/config/rbac/descoped/operator-cluster-role-binding-openshift.yaml",
 		)
 	} else {
 		return ResourcesOrCollect(ctx, c, namespace, collection, force, customizer,
-			"/config/rbac/openshift/namespaced/operator-role-openshift.yaml",
-			"/config/rbac/openshift/namespaced/operator-role-binding-openshift.yaml",
+			"/config/rbac/namespaced/operator-role-openshift.yaml",
+			"/config/rbac/namespaced/operator-role-binding-openshift.yaml",
 		)
 	}
 }

pkg/resources/config/rbac/descoped/kustomization.yaml

@@ -27,12 +27,14 @@ resources:
 - operator-cluster-role-keda.yaml
 - operator-cluster-role-knative.yaml
 - operator-cluster-role-leases.yaml
+- operator-cluster-role-openshift.yaml
 - operator-cluster-role-podmonitors.yaml
 - operator-cluster-role-strimzi.yaml
 - operator-cluster-role-binding-events.yaml
 - operator-cluster-role-binding-keda.yaml
 - operator-cluster-role-binding-knative.yaml
 - operator-cluster-role-binding-leases.yaml
+- operator-cluster-role-binding-openshift.yaml
 - operator-cluster-role-binding-podmonitors.yaml
 - operator-cluster-role-binding-strimzi.yaml
 - operator-cluster-role-binding.yaml

pkg/resources/config/rbac/namespaced/kustomization.yaml

@@ -27,12 +27,14 @@ resources:
 - operator-role-keda.yaml
 - operator-role-knative.yaml
 - operator-role-leases.yaml
+- operator-role-openshift.yaml
 - operator-role-podmonitors.yaml
 - operator-role-strimzi.yaml
 - operator-role-binding.yaml
 - operator-role-binding-events.yaml
 - operator-role-binding-keda.yaml
 - operator-role-binding-knative.yaml
 - operator-role-binding-leases.yaml
+- operator-role-binding-openshift.yaml
 - operator-role-binding-podmonitors.yaml
 - operator-role-binding-strimzi.yaml

pkg/resources/config/rbac/openshift/namespaced/operator-role-binding-openshift.yaml → pkg/resources/config/rbac/namespaced/operator-role-binding-openshift.yaml

@@ -27,4 +27,4 @@ subjects:
 roleRef:
   kind: Role
   name: camel-k-operator-openshift
-  apiGroup: rbac.authorization.k8s.io
+  apiGroup: rbac.authorization.k8s.io

pkg/resources/config/rbac/openshift/namespaced/operator-role-openshift.yaml → pkg/resources/config/rbac/namespaced/operator-role-openshift.yaml

@@ -96,4 +96,4 @@ rules:
   resources:
   - routes/custom-host
   verbs:
-  - create
+  - create