Enable RBAC and support using ServiceAccounts

[pwittrock]

As a CRD developer, in production I run my controller in a Namespace with a ServiceAccount and RBAC rules configured for it. I want the integration tests for my controller to mimic production as closely as possible and catch errors if the RBAC rules are incorrectly setup. To do this I need:

• RBAC to be enabled in the cluster
• To create a Namespace in the cluster and setup RBAC rules for my controller
• To get a Config (credentials) authorized as the ServiceAccount

[hoegaarden]

We discussed in the SIG-testing-commons meeting yesterday the longer term goal for this framework: It should have a API to ask for a k8s cluster (similar or a layer around the cluster API). A user should then be able to choose which cluster should be deployed and probably the default will be some sort of kubeadm DIND deployment. Other deployment options might also be available. The spec about that is in the works.

Now when you say you want "to mimic production as closely as possible" probably implementing this in our strategy (bringing up some binaries) is the wrong way to do it, but for that case the kubeadm DIND deployment should be used.

In case we add more and more things (RBAC, ...) to the current implementation and supporting them, will we end up rewriting something like kubeadm?

cc: @jamesjoshuahill @marun @timothysc @apelisse

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.