From 9a602f07b2cfdc77750790c7a24ce27aa78298d4 Mon Sep 17 00:00:00 2001
From: Said Boudjelda <bmscomp@gmail.com>
Date: Sun, 18 Oct 2026 15:52:21 +0200
Subject: [PATCH] fix(detect): the Strimzi operator lookup is not thrown off by
 "error" in any deployment's JSON

Detect lists every deployment in the cluster to find the Strimzi operator,
and fell back to namespace kafka whenever that JSON contained the text
"error" or "Forbidden". Any deployment with an argument like
--log-level=error matched, so an operator in strimzi-system went unseen,
detect reported Strimzi not running, and kates deploy and kates auto acted
on that.

The fallback now runs on what kubectl says, an error or no output, the way
a refusal arrives. TestGetStrimziStatus_FindsTheOperatorBesideAnErrorLogLevel
lists an ingress controller with --log-level=error beside the operator in
strimzi-system.
---
 cli/pkg/detect/collector.go      |  6 ++++--
 cli/pkg/detect/collector_test.go | 19 +++++++++++++++++++
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/cli/pkg/detect/collector.go b/cli/pkg/detect/collector.go
index 3deb2eee..9b1e170a 100644
--- a/cli/pkg/detect/collector.go
+++ b/cli/pkg/detect/collector.go
@@ -551,9 +551,11 @@ func (c *Collector) getStrimziStatus() StrimziInfo {
 	info.CRDsPresent = len(missingCRDs) == 0
 	info.Health.MissingCRDs = missingCRDs
 
-	// Find the deployment for strimzi operator (with permission-friendly namespace fallback)
+	// Find the deployment for strimzi operator (with permission-friendly namespace fallback).
+	// A refusal is an error from kubectl; the JSON of every deployment in the
+	// cluster may say "error" anywhere, a --log-level=error argument included.
 	depOut, err := c.exec.Exec("kubectl", "get", "deployment", "-A", "-o", "json")
-	if err != nil || depOut == "" || strings.Contains(depOut, "Forbidden") || strings.Contains(depOut, "error") {
+	if err != nil || depOut == "" {
 		// Fallback: check in the kafka namespace
 		depOut, _ = c.exec.Exec("kubectl", "get", "deployment", "-n", "kafka", "-o", "json")
 	}
diff --git a/cli/pkg/detect/collector_test.go b/cli/pkg/detect/collector_test.go
index 1b6fbb63..4e268915 100644
--- a/cli/pkg/detect/collector_test.go
+++ b/cli/pkg/detect/collector_test.go
@@ -165,6 +165,25 @@ func TestCollect_NoStrimzi(t *testing.T) {
 	}
 }
 
+// The lookup read any "error" in the JSON of every deployment as a failed
+// kubectl, so one --log-level=error argument anywhere sent it to namespace
+// kafka, and an operator in strimzi-system went unseen.
+func TestGetStrimziStatus_FindsTheOperatorBesideAnErrorLogLevel(t *testing.T) {
+	m := NewMockExecutor()
+	m.Set(`{"items":[
+	  {"metadata":{"name":"ingress-nginx-controller","namespace":"ingress"},
+	   "spec":{"template":{"spec":{"containers":[{"image":"ingress-nginx:1.12","args":["--log-level=error"]}]}}}},
+	  {"metadata":{"name":"strimzi-cluster-operator","namespace":"strimzi-system"},
+	   "spec":{"template":{"spec":{"containers":[{"image":"quay.io/strimzi/operator:0.48.0"}]}}},
+	   "status":{"readyReplicas":1,"replicas":1}}]}`,
+		"kubectl", "get", "deployment", "-A", "-o", "json")
+
+	info := NewCollector(m).getStrimziStatus()
+	if !info.Running || info.Namespace != "strimzi-system" || info.Image != "quay.io/strimzi/operator:0.48.0" {
+		t.Errorf("Running %v in %q with image %q, want the operator in strimzi-system", info.Running, info.Namespace, info.Image)
+	}
+}
+
 func TestCollect_SingleZone(t *testing.T) {
 	singleNodeJSON := `{
   "items": [