Revert "feat: add configurable namespace for activation job pods"

.github/workflows/pr.yml

@@ -16,7 +16,6 @@ jobs:
           - SCENARIO: externaldb
           - SCENARIO: ingress
           - SCENARIO: event_persistence
-          - SCENARIO: activation_job_namespace
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4
@@ -69,10 +68,6 @@ jobs:
         run: kubectl apply -f .ci/eda-event-stream-external-database.secret.yaml
         if: ${{ matrix.SCENARIO == 'externaldb' }}
 
-      - name: Create activation job namespace
-        run: kubectl create namespace eda-jobs
-        if: ${{ matrix.SCENARIO == 'activation_job_namespace' }}
-
       - name: Create the EDA demo CR
         run: |
           kubectl apply -f .ci/eda_v1alpha1_eda.${{ matrix.SCENARIO }}.ci.yaml

config/crd/bases/eda.ansible.com_edas.yaml

@@ -2943,13 +2943,6 @@ spec:
               activation_worker:
                 description: Defines desired state of eda-activation-worker resources
                 properties:
-                  activation_job_namespace:
-                    description: Kubernetes namespace where activation job pods are
-                      created. When set, jobs run in this namespace instead of the
-                      EDA operator namespace. The operator creates the necessary
-                      RBAC to allow the EDA service account to manage resources
-                      in the target namespace.
-                    type: string
                   node_selector:
                     additionalProperties:
                       type: string

config/rbac/kustomization.yaml

@@ -12,5 +12,3 @@ resources:
 - metrics_auth_role.yaml
 - metrics_auth_role_binding.yaml
 - metrics_reader_role.yaml
-- activation_job_namespace_role.yaml
-- activation_job_namespace_role_binding.yaml

roles/eda/defaults/main.yml

@@ -61,7 +61,6 @@ _activation_worker:
   node_selector: {}
   tolerations: []
   affinity: {}
-  activation_job_namespace: ""
 
 # Note: Deprecated "worker: {}" is intentionally excluded here so we know if the user set it
 _worker: {}

roles/eda/tasks/deploy_eda.yml

@@ -19,43 +19,6 @@
     event_stream_mtls_base_url: "{{ public_base_url.rstrip('/') }}/{{ event_stream_mtls_prefix_path }}"
   when: public_base_url | default('') | length > 0
 
-- name: Look up existing ConfigMap for previous activation_job_namespace
-  kubernetes.core.k8s_info:
-    api_version: v1
-    kind: ConfigMap
-    namespace: "{{ ansible_operator_meta.namespace }}"
-    name: "{{ ansible_operator_meta.name }}-{{ deployment_type }}-env-properties"
-  register: _eda_env_cm
-
-- name: Record previous activation_job_namespace from ConfigMap
-  ansible.builtin.set_fact:
-    _previous_activation_job_namespace: >-
-      {{ (_eda_env_cm.resources | first).data.EDA_ACTIVATION_JOB_NAMESPACE | default('') }}
-  when:
-    - _eda_env_cm.resources | length > 0
-    - (_eda_env_cm.resources | first).data is defined
-
-- name: Apply cross-namespace RBAC for activation job pods
-  k8s:
-    apply: yes
-    definition: "{{ lookup('template', 'eda-activation-job-namespace-rbac.yaml.j2') }}"
-    wait: yes
-  when: combined_activation_worker.activation_job_namespace | default('') | length > 0
-
-- name: Remove cross-namespace RBAC from previous namespace
-  k8s:
-    state: absent
-    api_version: rbac.authorization.k8s.io/v1
-    kind: "{{ item.kind }}"
-    name: "{{ ansible_operator_meta.name }}-activation-job-manager"
-    namespace: "{{ _previous_activation_job_namespace }}"
-  loop:
-    - { kind: RoleBinding }
-    - { kind: Role }
-  when:
-    - _previous_activation_job_namespace | default('') | length > 0
-    - combined_activation_worker.activation_job_namespace | default('') != _previous_activation_job_namespace
-
 - name: Apply ConfigMap resources
   k8s:
     apply: yes

roles/eda/templates/eda-api.networkpolicy.yaml.j2

@@ -47,22 +47,13 @@ spec:
         - protocol: TCP
           port: {{ websocket_port }}
     # Allow traffic from activation Job pods (created at runtime by activation
-    # workers, not operator-managed, carry only app: eda).
+    # workers, not operator-managed — carry only app: eda).
     # ansible_rulebook connects to daphne (websocket_port) for rulebook
     # execution and to the API (api_nginx_port) for token refresh.
     - from:
-{% if combined_activation_worker.activation_job_namespace | default('') | length > 0 %}
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: '{{ combined_activation_worker.activation_job_namespace }}'
-          podSelector:
-            matchLabels:
-              app: eda
-{% else %}
         - podSelector:
             matchLabels:
               app: eda
-{% endif %}
       ports:
         - protocol: TCP
           port: {{ websocket_port }}

roles/eda/templates/eda.configmap.yaml.j2

@@ -45,10 +45,6 @@ data:
 {% endif %}
 {% endif %}
 
-{% if combined_activation_worker.activation_job_namespace | default('') | length > 0 %}
-  EDA_ACTIVATION_JOB_NAMESPACE: "{{ combined_activation_worker.activation_job_namespace }}"
-{% endif %}
-
   # Custom user variables
 {% for item in extra_settings | default([]) %}
   {{ item.setting | upper }}: "{{ item.value }}"

roles/postgres/templates/postgres.networkpolicy.yaml.j2

@@ -34,20 +34,11 @@ spec:
             matchLabels:
               control-plane: controller-manager
         # EDA activation Job pods (created at runtime by activation workers,
-        # not operator-managed, carry only app: eda, no managed-by label).
+        # not operator-managed — carry only app: eda, no managed-by label).
         # Event stream activations connect to Postgres via pg_notify.
-{% if combined_activation_worker.activation_job_namespace | default('') | length > 0 %}
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: '{{ combined_activation_worker.activation_job_namespace }}'
-          podSelector:
-            matchLabels:
-              app: eda
-{% else %}
         - podSelector:
             matchLabels:
               app: eda
-{% endif %}
       ports:
         - protocol: TCP
           port: {{ eda_postgres_port | default('5432') }}