Make sidecar injector clusterrole more restrictive by specifying resourcenames

[neeleshkorade]

@sdake

Tested this manually for-

1. go templating
2. functionality by verifying in our test cluster that auto injection of sidecar works with the updated role

[howardjohn]

minor point: I think this can just be ["istio-sidecar-injector-{{.Release.Namespace}"] or does that not work?

[sdake]

good point - worth simplifying this if posible.

[neeleshkorade]

Thanks @howardjohn. I updated the PR with the suggested change.

[howardjohn]

Nice! a good part of istio/istio#14158

@sdake I've heard you have looked into the cluster roles a lot if you know of any reason why this isn't safe? Otherwise lgtm

[sdake]

@howardjohn looks good to me - @neeleshkorade contacted me prior to the submission. As a check is failing, we need to sort that out.

Cheers
-steve

[sdake]

gate failure

kubectl wait routes helloworld-go --for=condition=ready --timeout=240s
Error from server (NotFound): routes.serving.knative.dev "helloworld-go" not found
make: *** [test/noauth.mk:55: run-test-knative] Error 1
Makefile:165: recipe for target 'docker-run-test' failed
make: *** [docker-run-test] Error 2
Exited with code 2

[sdake]

/lgtm

waiting on experiments to determine if the simplification produces desired results.

[sdake]

good point - worth simplifying this if posible.

[howardjohn]

gate failure

kubectl wait routes helloworld-go --for=condition=ready --timeout=240s
Error from server (NotFound): routes.serving.knative.dev "helloworld-go" not found
make: *** [test/noauth.mk:55: run-test-knative] Error 1
Makefile:165: recipe for target 'docker-run-test' failed
make: *** [docker-run-test] Error 2
Exited with code 2

I think this is a flake, should be investigated