ApiServerSource does individual SubjectAccessReview requests when all namespaces are selected

[rh-hemartin]

Describe the bug

When an empty selector is used on an ApiServerSource to match all namespaces, it checks permissions with SubjectAccessReview for all namespaces individually.

Expected behavior

The ApiServerSource does a single SubjectAccessReview with the namespace set to an empty string, which makes Kubernetes check for all the cluster at once. See resourceAttributes.namespace on the authorization reference.

To Reproduce

See https://gist.github.com/rh-hemartin/1492d8985515ed77ff2c574afd35d471

Knative release version

v1.18.2

Additional context

None

[github-actions[bot]]

This issue is stale because it has been open for 90 days with no activity. It will automatically close after 30 more days of inactivity. Reopen the issue with /reopen. Mark the issue as fresh by adding the comment /remove-lifecycle stale.

[creydr]

/remove-lifecycle stale