Repository: knative-sandbox/eventing-kafka-broker
Pull request #2028 (2022-03-23 18:25:59)

[release-1.3] Make it possible to specify auth secret namespace in configmap
This is an automated cherry-pick of #2012

```release-note

```

knative-prow-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/eventing-kafka-broker/pull/2028#" title="Author self-approved">knative-prow-robot</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **dprotaso** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @dprotaso` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Feventing-kafka-broker).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/knative-sandbox/eventing-kafka-broker/blob/release-1.3/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["dprotaso"]} -->
codecov[bot]: # [Codecov](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2028?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) Report
> :exclamation: No coverage uploaded for pull request base (`release-1.3@2dd36ed`). [Click here to learn what that means](https://docs.codecov.io/docs/error-reference?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#section-missing-base-commit).
> The diff coverage is `n/a`.

```diff
@@              Coverage Diff               @@
##             release-1.3    #2028   +/-   ##
==============================================
  Coverage               ?   67.22%           
  Complexity             ?      633           
==============================================
  Files                  ?      141           
  Lines                  ?     6709           
  Branches               ?      181           
==============================================
  Hits                   ?     4510           
  Misses                 ?     1828           
  Partials               ?      371           
```

| Flag | Coverage Δ | |
|---|---|---|
| java-unittests | `81.82% <0.00%> (?)` | |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#carryforward-flags-in-the-pull-request-comment) to find out more.


------

[Continue to review full report at Codecov](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2028?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2028?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox). Last update [2dd36ed...cf457aa](https://codecov.io/gh/knative-sandbox/eventing-kafka-broker/pull/2028?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox).

aliok: /retest

```
Pod scheduling timeout. 
```

/lgtm
/approve
knative-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/eventing-kafka-broker/pull/2028#issuecomment-1077266264" title="Approved">aliok</a>*, *<a href="https://github.com/knative-sandbox/eventing-kafka-broker/pull/2028#" title="Author self-approved">knative-prow-robot</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Feventing-kafka-broker).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/knative-sandbox/eventing-kafka-broker/blob/release-1.3/OWNERS)~~ [aliok]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
knative-prow-robot: @knative-prow-robot: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
upgrade-tests_eventing-kafka-broker_release-1.3 | cf457aa688fded720f881f009c7a752bc2bb6a6d | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_eventing-kafka-broker/2028/upgrade-tests_eventing-kafka-broker_release-1.3/1506875411508760576) | true | `/test upgrade-tests_eventing-kafka-broker_release-1.3`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_eventing-kafka-broker/2028). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-prow-robot).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @knative-prow-robot: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
upgrade-tests_eventing-kafka-broker_release-1.3 | cf457aa688fded720f881f009c7a752bc2bb6a6d | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_eventing-kafka-broker/2028/upgrade-tests_eventing-kafka-broker_release-1.3/1506875411508760576) | true | `/test upgrade-tests_eventing-kafka-broker_release-1.3`
unit-tests_eventing-kafka-broker_release-1.3 | cf457aa688fded720f881f009c7a752bc2bb6a6d | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_eventing-kafka-broker/2028/unit-tests_eventing-kafka-broker_release-1.3/1506875411424874496) | true | `/test unit-tests_eventing-kafka-broker_release-1.3`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_eventing-kafka-broker/2028). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-prow-robot).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
knative-prow-robot: @knative-prow-robot: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
upgrade-tests_eventing-kafka-broker_release-1.3 | cf457aa688fded720f881f009c7a752bc2bb6a6d | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_eventing-kafka-broker/2028/upgrade-tests_eventing-kafka-broker_release-1.3/1506875411508760576) | true | `/test upgrade-tests_eventing-kafka-broker_release-1.3`
unit-tests_eventing-kafka-broker_release-1.3 | cf457aa688fded720f881f009c7a752bc2bb6a6d | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_eventing-kafka-broker/2028/unit-tests_eventing-kafka-broker_release-1.3/1506875411424874496) | true | `/test unit-tests_eventing-kafka-broker_release-1.3`
build-tests_eventing-kafka-broker_release-1.3 | cf457aa688fded720f881f009c7a752bc2bb6a6d | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_eventing-kafka-broker/2028/build-tests_eventing-kafka-broker_release-1.3/1506875411399708672) | true | `/test build-tests_eventing-kafka-broker_release-1.3`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_eventing-kafka-broker/2028). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-prow-robot).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
aliok: /retest
knative-prow-robot: @knative-prow-robot: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
unit-tests_eventing-kafka-broker_release-1.3 | cf457aa688fded720f881f009c7a752bc2bb6a6d | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_eventing-kafka-broker/2028/unit-tests_eventing-kafka-broker_release-1.3/1506875411424874496) | true | `/test unit-tests_eventing-kafka-broker_release-1.3`
build-tests_eventing-kafka-broker_release-1.3 | cf457aa688fded720f881f009c7a752bc2bb6a6d | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_eventing-kafka-broker/2028/build-tests_eventing-kafka-broker_release-1.3/1506875411399708672) | true | `/test build-tests_eventing-kafka-broker_release-1.3`
upgrade-tests_eventing-kafka-broker_release-1.3 | cf457aa688fded720f881f009c7a752bc2bb6a6d | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_eventing-kafka-broker/2028/upgrade-tests_eventing-kafka-broker_release-1.3/1506963605155745792) | true | `/test upgrade-tests_eventing-kafka-broker_release-1.3`

[Full PR test history](https://gubernator.knative.dev/pr/knative-sandbox_eventing-kafka-broker/2028). [Your PR dashboard](https://gubernator.knative.dev/pr/knative-prow-robot).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
aliok: cc @pierDipi do you know about this error here?
aliok: /retest

Patch:
diff --git a/control-plane/pkg/reconciler/broker/broker.go b/control-plane/pkg/reconciler/broker/broker.go
index ca69b2c57..7c67c24c6 100644
--- a/control-plane/pkg/reconciler/broker/broker.go
+++ b/control-plane/pkg/reconciler/broker/broker.go
@@ -102,7 +102,7 @@ func (r *Reconciler) reconcileKind(ctx context.Context, broker *eventing.Broker)
 
 	logger.Debug("config resolved", zap.Any("config", topicConfig))
 
-	secret, err := security.Secret(ctx, &security.MTConfigMapSecretLocator{ConfigMap: brokerConfig}, r.SecretProviderFunc())
+	secret, err := security.Secret(ctx, &security.MTConfigMapSecretLocator{ConfigMap: brokerConfig, UseNamespaceInConfigmap: false}, r.SecretProviderFunc())
 	if err != nil {
 		return fmt.Errorf("failed to get secret: %w", err)
 	}
@@ -323,7 +323,7 @@ func (r *Reconciler) finalizeKind(ctx context.Context, broker *eventing.Broker)
 		return fmt.Errorf("failed to resolve broker config: %w", err)
 	}
 
-	secret, err := security.Secret(ctx, &security.MTConfigMapSecretLocator{ConfigMap: brokerConfig}, r.SecretProviderFunc())
+	secret, err := security.Secret(ctx, &security.MTConfigMapSecretLocator{ConfigMap: brokerConfig, UseNamespaceInConfigmap: false}, r.SecretProviderFunc())
 	if err != nil {
 		return fmt.Errorf("failed to get secret: %w", err)
 	}
diff --git a/control-plane/pkg/reconciler/channel/channel.go b/control-plane/pkg/reconciler/channel/channel.go
index da58834d6..c9d78e7b4 100644
--- a/control-plane/pkg/reconciler/channel/channel.go
+++ b/control-plane/pkg/reconciler/channel/channel.go
@@ -127,7 +127,7 @@ func (r *Reconciler) reconcileKind(ctx context.Context, channel *messagingv1beta
 	statusConditionManager.ConfigResolved()
 
 	// get the secret to access Kafka
-	secret, err := security.Secret(ctx, &security.MTConfigMapSecretLocator{ConfigMap: channelConfigMap}, r.SecretProviderFunc())
+	secret, err := security.Secret(ctx, &security.MTConfigMapSecretLocator{ConfigMap: channelConfigMap, UseNamespaceInConfigmap: true}, r.SecretProviderFunc())
 	if err != nil {
 		return fmt.Errorf("failed to get secret: %w", err)
 	}
@@ -275,7 +275,9 @@ func (r *Reconciler) reconcileKind(ctx context.Context, channel *messagingv1beta
 		},
 	}
 
+	logger.Debug("Going to probe address to check ingress readiness for the channel.", zap.Any("proberAddressable", proberAddressable))
 	if status := r.Prober.Probe(ctx, proberAddressable, prober.StatusReady); status != prober.StatusReady {
+		logger.Debug("Ingress is not ready for the channel. Going to requeue.", zap.Any("proberAddressable", proberAddressable))
 		statusConditionManager.ProbesStatusNotReady(status)
 		return nil // Object will get re-queued once probe status changes.
 	}
@@ -374,7 +376,7 @@ func (r *Reconciler) finalizeKind(ctx context.Context, channel *messagingv1beta1
 	logger.Debug("topic config resolved", zap.Any("config", topicConfig))
 
 	// get the secret to access Kafka
-	secret, err := security.Secret(ctx, &security.MTConfigMapSecretLocator{ConfigMap: channelConfigMap}, r.SecretProviderFunc())
+	secret, err := security.Secret(ctx, &security.MTConfigMapSecretLocator{ConfigMap: channelConfigMap, UseNamespaceInConfigmap: true}, r.SecretProviderFunc())
 	if err != nil {
 		return fmt.Errorf("failed to get secret: %w", err)
 	}
diff --git a/control-plane/pkg/reconciler/channel/v2/channelv2.go b/control-plane/pkg/reconciler/channel/v2/channelv2.go
index 417a2a698..f143e9586 100644
--- a/control-plane/pkg/reconciler/channel/v2/channelv2.go
+++ b/control-plane/pkg/reconciler/channel/v2/channelv2.go
@@ -132,7 +132,7 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, channel *messagingv1beta
 	statusConditionManager.ConfigResolved()
 
 	// get the secret to access Kafka
-	secret, err := security.Secret(ctx, &security.MTConfigMapSecretLocator{ConfigMap: channelConfigMap}, r.SecretProviderFunc())
+	secret, err := security.Secret(ctx, &security.MTConfigMapSecretLocator{ConfigMap: channelConfigMap, UseNamespaceInConfigmap: true}, r.SecretProviderFunc())
 	if err != nil {
 		return fmt.Errorf("failed to get secret: %w", err)
 	}
@@ -372,7 +372,7 @@ func (r *Reconciler) FinalizeKind(ctx context.Context, channel *messagingv1beta1
 	logger.Debug("topic config resolved", zap.Any("config", topicConfig))
 
 	// get the secret to access Kafka
-	secret, err := security.Secret(ctx, &security.MTConfigMapSecretLocator{ConfigMap: channelConfigMap}, r.SecretProviderFunc())
+	secret, err := security.Secret(ctx, &security.MTConfigMapSecretLocator{ConfigMap: channelConfigMap, UseNamespaceInConfigmap: true}, r.SecretProviderFunc())
 	if err != nil {
 		return fmt.Errorf("failed to get secret: %w", err)
 	}
diff --git a/control-plane/pkg/security/config.go b/control-plane/pkg/security/config.go
index 22b2f1b45..0c76404d5 100644
--- a/control-plane/pkg/security/config.go
+++ b/control-plane/pkg/security/config.go
@@ -30,7 +30,8 @@ import (
 )
 
 const (
-	AuthSecretNameKey = "auth.secret.ref.name" /* #nosec G101 */ /* Potential hardcoded credentials (gosec) */
+	AuthSecretNameKey      = "auth.secret.ref.name"      /* #nosec G101 */ /* Potential hardcoded credentials (gosec) */
+	AuthSecretNamespaceKey = "auth.secret.ref.namespace" /* #nosec G101 */ /* Potential hardcoded credentials (gosec) */
 )
 
 // SecretLocator locates a secret in a cluster.
@@ -97,10 +98,13 @@ func DefaultSecretProviderFunc(lister corelisters.SecretLister, kc kubernetes.In
 
 // MTConfigMapSecretLocator is a SecretLocator that locates a secret using a reference in a ConfigMap.
 //
-// The name is take from the data field using the key: AuthSecretNameKey.
-// The namespace is the same namespace of the ConfigMap.
+// The name is taken from the data field using the key: AuthSecretNameKey.
+// When UseNamespaceInConfigmap=true, the namespace is taken from the data field using the
+// key: AuthSecretNamespaceKey. When false, namespace of the ConfigMap is returned.
 type MTConfigMapSecretLocator struct {
 	*corev1.ConfigMap
+	// if false, secret namespace is NOT read from the configmap
+	UseNamespaceInConfigmap bool
 }
 
 func (cmp *MTConfigMapSecretLocator) SecretName() (string, bool) {
@@ -112,5 +116,11 @@ func (cmp *MTConfigMapSecretLocator) SecretName() (string, bool) {
 }
 
 func (cmp *MTConfigMapSecretLocator) SecretNamespace() (string, bool) {
+	if cmp.UseNamespaceInConfigmap {
+		if v, ok := cmp.Data[AuthSecretNamespaceKey]; ok && len(v) > 0 {
+			return v, ok
+		}
+	}
+
 	return cmp.Namespace, true
 }


Test patch:
diff --git a/control-plane/pkg/reconciler/channel/channel_test.go b/control-plane/pkg/reconciler/channel/channel_test.go
index 21f8c9ced..cf9437fc0 100644
--- a/control-plane/pkg/reconciler/channel/channel_test.go
+++ b/control-plane/pkg/reconciler/channel/channel_test.go
@@ -1023,9 +1023,10 @@ func TestReconcileKind(t *testing.T) {
 				NewConfigMapWithTextData(system.Namespace(), DefaultEnv.GeneralConfigMapName, map[string]string{
 					kafka.BootstrapServersConfigMapKey: ChannelBootstrapServers,
 					security.AuthSecretNameKey:         "secret-1",
+					security.AuthSecretNamespaceKey:    "ns-1",
 				}),
 				NewConfigMapWithBinaryData(&env, nil),
-				NewSSLSecret(system.Namespace(), "secret-1"),
+				NewSSLSecret("ns-1", "secret-1"),
 			},
 			Key: testKey,
 			WantUpdates: []clientgotesting.UpdateActionImpl{
@@ -1040,7 +1041,7 @@ func TestReconcileKind(t *testing.T) {
 							Auth: &contract.Resource_AuthSecret{
 								AuthSecret: &contract.Reference{
 									Uuid:      SecretUUID,
-									Namespace: system.Namespace(),
+									Namespace: "ns-1",
 									Name:      "secret-1",
 									Version:   SecretResourceVersion,
 								},
diff --git a/control-plane/pkg/reconciler/channel/v2/channelv2_test.go b/control-plane/pkg/reconciler/channel/v2/channelv2_test.go
index be8ce3afb..81d858eab 100644
--- a/control-plane/pkg/reconciler/channel/v2/channelv2_test.go
+++ b/control-plane/pkg/reconciler/channel/v2/channelv2_test.go
@@ -1032,9 +1032,10 @@ func TestReconcileKind(t *testing.T) {
 				NewConfigMapWithTextData(system.Namespace(), DefaultEnv.GeneralConfigMapName, map[string]string{
 					kafka.BootstrapServersConfigMapKey: ChannelBootstrapServers,
 					security.AuthSecretNameKey:         "secret-1",
+					security.AuthSecretNamespaceKey:    "ns-1",
 				}),
 				NewConfigMapWithBinaryData(&env, nil),
-				NewSSLSecret(system.Namespace(), "secret-1"),
+				NewSSLSecret("ns-1", "secret-1"),
 				NewConsumerGroup(
 					WithConsumerGroupName(Subscription1UUID),
 					WithConsumerGroupNamespace(ChannelNamespace),
@@ -1066,7 +1067,7 @@ func TestReconcileKind(t *testing.T) {
 							Auth: &contract.Resource_AuthSecret{
 								AuthSecret: &contract.Reference{
 									Uuid:      SecretUUID,
-									Namespace: system.Namespace(),
+									Namespace: "ns-1",
 									Name:      "secret-1",
 									Version:   SecretResourceVersion,
 								},
diff --git a/control-plane/pkg/security/config_test.go b/control-plane/pkg/security/config_test.go
index d0e75efe5..bf0444e03 100644
--- a/control-plane/pkg/security/config_test.go
+++ b/control-plane/pkg/security/config_test.go
@@ -61,16 +61,52 @@ func TestSecret(t *testing.T) {
 		wantErr            bool
 	}{
 		{
-			name: "happy case",
+			name: "happy case - use configmap namespace",
 			ctx:  context.Background(),
 			config: &MTConfigMapSecretLocator{
-				&corev1.ConfigMap{
+				UseNamespaceInConfigmap: false,
+				ConfigMap: &corev1.ConfigMap{
 					ObjectMeta: metav1.ObjectMeta{
 						Namespace: "my-ns",
 						Name:      "my-name",
 					},
 					Data: map[string]string{
-						AuthSecretNameKey: "my-name",
+						AuthSecretNameKey:      "my-name",
+						AuthSecretNamespaceKey: "NOT_USED",
+					},
+				},
+			},
+			secretProviderFunc: (&SecretProviderFuncMock{
+				secret: &corev1.Secret{
+					Data: map[string][]byte{
+						ProtocolKey: []byte(ProtocolPlaintext),
+					},
+				},
+				err:           nil,
+				wantName:      "my-name",
+				wantNamespace: "my-ns",
+				t:             t,
+			}).F,
+			wantSecret: &corev1.Secret{
+				Data: map[string][]byte{
+					ProtocolKey: []byte(ProtocolPlaintext),
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "happy case - use namespace in configmap",
+			ctx:  context.Background(),
+			config: &MTConfigMapSecretLocator{
+				UseNamespaceInConfigmap: true,
+				ConfigMap: &corev1.ConfigMap{
+					ObjectMeta: metav1.ObjectMeta{
+						Namespace: "my-ns",
+						Name:      "my-name",
+					},
+					Data: map[string]string{
+						AuthSecretNamespaceKey: "my-ns",
+						AuthSecretNameKey:      "my-name",
 					},
 				},
 			},
@@ -95,14 +131,15 @@ func TestSecret(t *testing.T) {
 		{
 			name:       "no secret in MTConfigMapSecretLocator config",
 			ctx:        context.Background(),
-			config:     &MTConfigMapSecretLocator{nil},
+			config:     &MTConfigMapSecretLocator{ConfigMap: nil},
 			wantSecret: nil,
 		},
 		{
 			name: "no secret in MTConfigMapSecretLocator",
 			ctx:  context.Background(),
 			config: &MTConfigMapSecretLocator{
-				&corev1.ConfigMap{
+				UseNamespaceInConfigmap: false,
+				ConfigMap: &corev1.ConfigMap{
 					ObjectMeta: metav1.ObjectMeta{
 						Namespace: "my-ns",
 						Name:      "my-name",
@@ -117,13 +154,15 @@ func TestSecret(t *testing.T) {
 			name: "secret provider error",
 			ctx:  context.Background(),
 			config: &MTConfigMapSecretLocator{
-				&corev1.ConfigMap{
+				UseNamespaceInConfigmap: false,
+				ConfigMap: &corev1.ConfigMap{
 					ObjectMeta: metav1.ObjectMeta{
 						Namespace: "my-ns",
 						Name:      "my-name",
 					},
 					Data: map[string]string{
-						AuthSecretNameKey: "my-name",
+						AuthSecretNameKey:      "my-name",
+						AuthSecretNamespaceKey: "my-ns",
 					},
 				},
 			},
diff --git a/test/e2e-common.sh b/test/e2e-common.sh
index 6261e71e9..a7c8394d0 100644
--- a/test/e2e-common.sh
+++ b/test/e2e-common.sh
@@ -270,19 +270,19 @@ function setup_kafka_channel_auth() {
     kubectl patch configmap/kafka-channel-config \
       -n knative-eventing \
       --type merge \
-      -p '{"data":{"bootstrap.servers":"my-cluster-kafka-bootstrap.kafka:9093", "auth.secret.ref.name": "strimzi-tls-secret"}}'
+      -p '{"data":{"bootstrap.servers":"my-cluster-kafka-bootstrap.kafka:9093", "auth.secret.ref.name": "strimzi-tls-secret", "auth.secret.ref.namespace": "knative-eventing"}}'
   elif [ "$EVENTING_KAFKA_BROKER_CHANNEL_AUTH_SCENARIO" == "SASL_SSL" ]; then
     echo "Setting up SASL_SSL configuration for KafkaChannel"
     kubectl patch configmap/kafka-channel-config \
       -n knative-eventing \
       --type merge \
-      -p '{"data":{"bootstrap.servers":"my-cluster-kafka-bootstrap.kafka:9094", "auth.secret.ref.name": "strimzi-sasl-secret"}}'
+      -p '{"data":{"bootstrap.servers":"my-cluster-kafka-bootstrap.kafka:9094", "auth.secret.ref.name": "strimzi-sasl-secret", "auth.secret.ref.namespace": "knative-eventing"}}'
   elif [ "$EVENTING_KAFKA_BROKER_CHANNEL_AUTH_SCENARIO" == "SASL_PLAIN" ]; then
     echo "Setting up SASL_PLAIN configuration for KafkaChannel"
     kubectl patch configmap/kafka-channel-config \
       -n knative-eventing \
       --type merge \
-      -p '{"data":{"bootstrap.servers":"my-cluster-kafka-bootstrap.kafka:9095", "auth.secret.ref.name": "strimzi-sasl-plain-secret"}}'
+      -p '{"data":{"bootstrap.servers":"my-cluster-kafka-bootstrap.kafka:9095", "auth.secret.ref.name": "strimzi-sasl-plain-secret", "auth.secret.ref.namespace": "knative-eventing"}}'
   else
     echo "Setting up no auth configuration for KafkaChannel"
     kubectl patch configmap/kafka-channel-config \
@@ -292,6 +292,6 @@ function setup_kafka_channel_auth() {
     kubectl patch configmap/kafka-channel-config \
       -n knative-eventing \
       --type=json \
-      -p='[{"op": "remove", "path": "/data/auth.secret.ref.name"}]' || true
+      -p='[{"op": "remove", "path": "/data/auth.secret.ref.name"}, {"op": "remove", "path": "/data/auth.secret.ref.namespace"}]' || true
   fi
 }