Fix verify: regenerate bundle via make bundle with kubebuilder RBAC markers

Remove config/console from kustomize manifests (Console resources are now
created at runtime, not by OLM). Add kubebuilder RBAC markers for
console.openshift.io and clusterversions so make bundle generates the
correct CSV permissions.

Author: sebrandon1

bundle/manifests/cert-manager-operator.clusterserviceversion.yaml

@@ -410,25 +410,9 @@ spec:
         - apiGroups:
           - config.openshift.io
           resources:
-          - clusterversions
           - featuregates
           verbs:
           - get
-          - list
-          - watch
-        - apiGroups:
-          - console.openshift.io
-          resources:
-          - consolequickstarts
-          - consoleyamlsamples
-          verbs:
-          - create
-          - delete
-          - get
-          - list
-          - patch
-          - update
-          - watch
         - apiGroups:
           - ""
           resources:
@@ -584,6 +568,7 @@ spec:
           - config.openshift.io
           resources:
           - apiservers
+          - clusterversions
           verbs:
           - get
           - list
@@ -603,6 +588,19 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - console.openshift.io
+          resources:
+          - consolequickstarts
+          - consoleyamlsamples
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
         - apiGroups:
           - coordination.k8s.io
           resources:

config/manifests/kustomization.yaml

@@ -5,7 +5,6 @@ resources:
 - ../default
 - ../samples
 - ../scorecard
-- ../console
 
 # [WEBHOOK] To enable webhooks, uncomment all the sections with [WEBHOOK] prefix.
 # Do NOT uncomment sections with prefix [CERTMANAGER], as OLM does not support cert-manager.

config/rbac/role.yaml

@@ -159,6 +159,7 @@ rules:
   - config.openshift.io
   resources:
   - apiservers
+  - clusterversions
   verbs:
   - get
   - list
@@ -178,6 +179,19 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - console.openshift.io
+  resources:
+  - consolequickstarts
+  - consoleyamlsamples
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - coordination.k8s.io
   resources:

pkg/controller/certmanager/console_resources.go

@@ -48,6 +48,9 @@ var (
 	}
 )
 
+// +kubebuilder:rbac:groups=config.openshift.io,resources=clusterversions,verbs=get;list;watch
+// +kubebuilder:rbac:groups=console.openshift.io,resources=consoleyamlsamples;consolequickstarts,verbs=get;list;watch;create;update;patch;delete
+
 // consoleResourcesController conditionally creates Console resources
 // (ConsoleYAMLSample, ConsoleQuickStart) when the Console capability
 // is enabled on the cluster.