OCPBUGS-21776: Cluster-policy-controller: add missing RBAC for privileged namespaces PSA syncer controller

[muraee]

PriviligedNamespacesPSALabelSyncer RBAC added in openshift/cluster-kube-controller-manager-operator#743

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #OCPBUGS-21776

Checklist

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

[openshift-ci-robot]

@muraee: This pull request references Jira Issue OCPBUGS-21776, which is invalid:

• expected the bug to target the "4.15.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

PriviligedNamespacesPSALabelSyncer RBAC added in openshift/cluster-kube-controller-manager-operator#743

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #OCPBUGS-21776

Checklist

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[muraee]

/jira refresh

[openshift-ci-robot]

@muraee: This pull request references Jira Issue OCPBUGS-21776, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.15.0) matches configured target version for branch (4.15.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @gkarager

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[enxebre]

/approve
do we want to have an e2e that let us watch priviledge being reapplied?

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre, muraee

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[muraee]

do we want to have an e2e that let us watch priviledge being reapplied?

@enxebre shouldn't this be already covered by the cluster-policy-controller e2e? I don't think we need our own test.

[enxebre]

@enxebre shouldn't this be already covered by the cluster-policy-controller e2e? I don't think we need our own test.

It's certainly not covered anywhere in the hypershift context as proven by this PR, expectations can break without us noticing - because of the split of responsibilities between the original operator and the cpo. I'm fine introducing e2e rigidness for this later on though.

[sjenning]

/lgtm

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD cf09187 and 2 for PR HEAD f64442b in total

[openshift-ci]

@muraee: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[openshift-ci-robot]

@muraee: Jira Issue OCPBUGS-21776: All pull requests linked via external trackers have merged:

• openshift/hypershift#3115

Jira Issue OCPBUGS-21776 has been moved to the MODIFIED state.

In response to this:

PriviligedNamespacesPSALabelSyncer RBAC added in openshift/cluster-kube-controller-manager-operator#743

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #OCPBUGS-21776

Checklist

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[muraee]

/cherry-pick release-4.14

[openshift-cherrypick-robot]

@muraee: new pull request created: #3131

In response to this:

/cherry-pick release-4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-merge-robot]

Fix included in accepted release 4.15.0-0.nightly-2023-10-25-052621