KubernetesAuthEngineRole unknown field "spec.targetNamespaceSelector"

[alex-old-user]

Hi, I believe there is a bug

as per https://github.com/redhat-cop/vault-config-operator/blob/main/docs/auth-engines.md#kubernetesauthenginerole
the KubernetesAuthEngineRole type has

spec:
  targetNamespaceSelector:

however, that's not the case. I've got the following error after applying the example

strict decoding error: unknown field "spec.targetNamespaceSelector"

checking the Golang types in api/v1alpha1/utils/commons.go and api/v1alpha1/kubernetesauthenginerole_types.go
shows

type KubernetesSecretEngineRoleSpec struct {
	Connection *vaultutils.VaultConnection `json:"connection,omitempty"`
	Authentication vaultutils.KubeAuthConfiguration `json:"authentication,omitempty"`
	Path vaultutils.Path `json:"path,omitempty"`
	TargetNamespaces vaultutils.TargetNamespaceConfig `json:"targetNamespaces,omitempty"`
	KubeSERole `json:",inline"`
}

type TargetNamespaceConfig struct {
	TargetNamespaceSelector *metav1.LabelSelector `json:"targetNamespaceSelector,omitempty"`
	TargetNamespaces []string `json:"targetNamespaces,omitempty"`
}

which corresponds to the following yaml

# either 

  targetNamespaces:
    targetNamespaces:
      - default
    
# or 

  targetNamespaces:
    targetNamespaceSelector:
      matchLabels:
        foo: bar

additionally, spec.targetNamespaces.targetNamespaces is hard to comprehend

[grandwizard28]

+1 on this.

1. Specifying

targetNamespaceSelector:
      matchLabels:
        foo: bar

(as per the documentation) fails with the error

Error from server (BadRequest): error when creating ********: KubernetesAuthEngineRole in version "v1alpha1" cannot be handled as a KubernetesAuthEngineRole: strict decoding error: unknown field "spec.targetNamespaceSelector"

2. Specifying

targetNamespaces:
   - default

fails with the error

Error from server: error when creating ********: admission webhook "mkubernetesauthenginerole.kb.io" denied the request: json: cannot unmarshal array into Go struct field KubernetesAuthEngineRoleSpec.spec.targetNamespaces of type utils.TargetNamespaceConfig

@alex-old-user has already pointed out the correct way of specifying either of them.