aggregate admin from edit and view to ensure coverage

[deads2k]

ClusterRole aggregate has worked quite well. This updates the edit role to be aggregated from a separate edit and view and updates the admin role to aggregated from admin, edit, and view. This ensures coverage (we previously had unit tests, but that didn't work as people aggregated more powers in) and it makes each role smaller since it only has a diff to consider.

@kubernetes/sig-auth-pr-reviews

admin RBAC role now aggregates edit and view.  edit RBAC role now aggregates view. 

[liggitt]

looks reasonable to me. can you verify reconciliation on this works properly in both directions? (a 1.12 apiserver would add the new selectors on startup, and a 1.11 server would not remove them on startup)

[liggitt]

needs a release note as well

[deads2k]

looks reasonable to me. can you verify reconciliation on this works properly in both directions? (a 1.12 apiserver would add the new selectors on startup, and a 1.11 server would not remove them on startup)

Labels don't collide with any reasonably existing thing and the reconcile attaches them: https://github.com/kubernetes/kubernetes/blob/master/pkg/registry/rbac/reconciliation/reconcile_role.go#L186-L194

[deads2k]

needs a release note as well

added

[enj]

Fancy.

[deads2k]

@mikedanese ptal.

[enj]

/lgtm

I see no test failures so if something is missing RBAC it needs to add a test that actually uses it 😄

[k8s-github-robot]

/test all

Tests are more than 96 hours old. Re-running tests.

[mikedanese]

This is much nicer.

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, enj, mikedanese

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• plugin/pkg/auth/OWNERS [deads2k,mikedanese]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-github-robot]

Automatic merge from submit-queue (batch tested with PRs 65730, 66615, 66684, 66519, 66510). If you want to cherry-pick this change to another branch, please follow the instructions here.

[neolit123]

/sig auth