Change internal-services-manager-role to namespace level

[hugares]

Replace the ClusterRole by a Role and ClusterRoleBinding by a RoleBinding as this is only required in the internal-services namespace. Doing it at the cluster level was granting unnecessary permission to the other namespaces on common clusters.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hugares

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• components/internal-services/OWNERS [hugares]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[johnbieren]

This comes from https://github.com/konflux-ci/internal-services/blob/main/config/rbac/role.yaml so I think it will be wiped out

[hugares]

This comes from https://github.com/konflux-ci/internal-services/blob/main/config/rbac/role.yaml so I think it will be wiped out

I did the change and if I run kustomize build locally, my change is not getting wiped out:

 kustomize build components/internal-services/internal-staging/ | grep internal-services-manager-rolebinding -B 7
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: rbac
    app.kubernetes.io/created-by: internal-services
    app.kubernetes.io/instance: internal-services-manager-rolebinding
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: clusterrolebinding
    app.kubernetes.io/part-of: internal-services
  name: internal-services-manager-rolebinding

[johnbieren]

This comes from https://github.com/konflux-ci/internal-services/blob/main/config/rbac/role.yaml so I think it will be wiped out

I did the change and if I run kustomize build locally, my change is not getting wiped out:

 kustomize build components/internal-services/internal-staging/ | grep internal-services-manager-rolebinding -B 7
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: rbac
    app.kubernetes.io/created-by: internal-services
    app.kubernetes.io/instance: internal-services-manager-rolebinding
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: clusterrolebinding
    app.kubernetes.io/part-of: internal-services
  name: internal-services-manager-rolebinding

Every time we merge a change to the internal-services repo, this file is overwritten in this repo

[hugares]

This comes from https://github.com/konflux-ci/internal-services/blob/main/config/rbac/role.yaml so I think it will be wiped out

I did the change and if I run kustomize build locally, my change is not getting wiped out:

 kustomize build components/internal-services/internal-staging/ | grep internal-services-manager-rolebinding -B 7
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: rbac
    app.kubernetes.io/created-by: internal-services
    app.kubernetes.io/instance: internal-services-manager-rolebinding
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: clusterrolebinding
    app.kubernetes.io/part-of: internal-services
  name: internal-services-manager-rolebinding

Every time we merge a change to the internal-services repo, this file is overwritten in this repo

I get it now, thanks for the explanation. Can we change this in source repo, are you ok with that?

[johnbieren]

This comes from https://github.com/konflux-ci/internal-services/blob/main/config/rbac/role.yaml so I think it will be wiped out

I did the change and if I run kustomize build locally, my change is not getting wiped out:

 kustomize build components/internal-services/internal-staging/ | grep internal-services-manager-rolebinding -B 7
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: rbac
    app.kubernetes.io/created-by: internal-services
    app.kubernetes.io/instance: internal-services-manager-rolebinding
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: clusterrolebinding
    app.kubernetes.io/part-of: internal-services
  name: internal-services-manager-rolebinding

Every time we merge a change to the internal-services repo, this file is overwritten in this repo

I get it now, thanks for the explanation. Can we change this in source repo, are you ok with that?

I am okay with it, but operator-sdk isn't. I just tried it (change ClusterRole to Role then make generate manifests) and it swaps it back. We ensure the manifests are valid in our CI (to ensure the CRDs is what we expect mostly). @davidmogar any ideas for how to achieve what we want here?

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.