fix scope of generated (Cluster)Role(Binding)s

[tamcore]

This should address the issue raised by @ctml91 via comment in my previous PR: #1262 (comment)

Now it'll take both watchNamespaces and namespaceScope into consideration, for determining if (Cluster)Role(Binding)s are supposed to be deployed.

• If namespaceScope is set, but watchNamespaces is not, it will default watchNamespaces to .Release.Namespace
• If watchNamespaces is set, namespaceScope is automatically assumed, even if not explitly set
• If watchNamespaces contains multiple, comma separated, namespaces, Role(Binding)s are generated for each namespace

Case 1:

• Installation to grafana-operator namespace, but explitly watching grafana1,grafana2

$ helm template --namespace grafana-operator . --values values.yaml -s templates/rbac.yaml --set watchNamespaces="grafana1\,grafana2" | yq '.rules = "deleted"'
---
# Source: grafana-operator/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: grafana1
  name: grafana-operator-permissions
rules: deleted
---
# Source: grafana-operator/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: grafana2
  name: grafana-operator-permissions
rules: deleted
---
# Source: grafana-operator/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: grafana-operator-permissions
  namespace: grafana1
subjects:
  - kind: ServiceAccount
    name: release-name-grafana-operator
    namespace: grafana-operator
roleRef:
  kind: Role
  name: grafana-operator-permissions
  apiGroup: rbac.authorization.k8s.io
rules: deleted
---
# Source: grafana-operator/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: grafana-operator-permissions
  namespace: grafana2
subjects:
  - kind: ServiceAccount
    name: release-name-grafana-operator
    namespace: grafana-operator
roleRef:
  kind: Role
  name: grafana-operator-permissions
  apiGroup: rbac.authorization.k8s.io
rules: deleted

Case 2

• Simply enabling namespaceScope

$ helm template --namespace grafana-operator . --values values.yaml -s templates/rbac.yaml --set namespaceScope=true | yq '.rules = "nothingtoseehere"'
---
# Source: grafana-operator/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: grafana-operator
  name: grafana-operator-permissions
rules: nothingtoseehere
---
# Source: grafana-operator/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: grafana-operator-permissions
  namespace: grafana-operator
subjects:
  - kind: ServiceAccount
    name: release-name-grafana-operator
    namespace: grafana-operator
roleRef:
  kind: Role
  name: grafana-operator-permissions
  apiGroup: rbac.authorization.k8s.io
rules: nothingtoseehere

Case 3

• bare defaults (cluster-wide installation)

$ helm template --namespace grafana-operator . --values values.yaml -s templates/rbac.yaml | yq '.rules = "nothingtoseehere"'
---
# Source: grafana-operator/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  namespace: grafana-operator
  name: grafana-operator-permissions
rules: nothingtoseehere
---
# Source: grafana-operator/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: grafana-operator-permissions
  namespace: grafana-operator
subjects:
  - kind: ServiceAccount
    name: release-name-grafana-operator
    namespace: grafana-operator
roleRef:
  kind: ClusterRole
  name: grafana-operator-permissions
  apiGroup: rbac.authorization.k8s.io
rules: nothingtoseehere

Case 4:

• setting both namespaceScope AND watchNamespaces (as you would have to currently)

$ helm template --namespace grafana-operator . --values values.yaml -s templates/rbac.yaml --set namespaceScope=true,watchNamespaces="grafana1\,grafana2" | yq '.rules = "deleted"'
---
# Source: grafana-operator/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: grafana1
  name: grafana-operator-permissions
rules: deleted
---
# Source: grafana-operator/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: grafana2
  name: grafana-operator-permissions
rules: deleted
---
# Source: grafana-operator/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: grafana-operator-permissions
  namespace: grafana1
subjects:
  - kind: ServiceAccount
    name: release-name-grafana-operator
    namespace: grafana-operator
roleRef:
  kind: Role
  name: grafana-operator-permissions
  apiGroup: rbac.authorization.k8s.io
rules: deleted
---
# Source: grafana-operator/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: grafana-operator-permissions
  namespace: grafana2
subjects:
  - kind: ServiceAccount
    name: release-name-grafana-operator
    namespace: grafana-operator
roleRef:
  kind: Role
  name: grafana-operator-permissions
  apiGroup: rbac.authorization.k8s.io
rules: deleted

[ctml91]

Thanks 🙏 will this correct the OLM manifests or is this change only affecting helm based installs?

[NissesSenap]

This only affects the helm installation @ctml91 .
But if you have time to look into how OLM does this, we would a PR around it.

[NissesSenap]

My head hurts from reading all the helm chart templates, but the output looks good :).
Really nice to generate out the namespace rbac to the watch namespaces as well.

The only issue I see if a user already has created the rbac settings for the operator with the exact same name. If that is the case, they will get an error when they try to update the helm chart.
Could it be worth adding some logic to the helm chart naming to make sure that doesn't happen.

Maybe add the namespace name as a prefix or something like that.

What do you think @tamcore ?

[NissesSenap]

FYI @smuda , good for you to know about.

[tamcore]

@NissesSenap not sure if i can follow 😅 but i guess it could make sense to prefix the generated resource names with the grafana-operator.fullname template, as it is in the other manifests as well.

[NissesSenap]

I changed my mind about the rbac names, sorry about that.
LGTM.