commands/.../new.go;pkg/scaffold: adding support for ClusterRole and ClusterRoleBinding

[joelanford]

Description of the change:

• Adds a new boolean flag to the operator-sdk new command called --cluster-scoped
• Adds IsClusterScoped field to the input.Input struct and other helper structs
• Updates Role and RoleBinding templates to be generated as ClusterRole and ClusterRoleBinding when IsClusterScoped is set to true.
• Updates unit associated unit tests
• Updates user guide to describe how to update the generated ClusterRoleBinding to set the namespace on the service account subject.

Motivation for the change:
See #736. This PR allows users to generate an operator that can be deployed with cluster scoped permissions by tweaking scaffolding of RBAC resources.

Given #236, I'm not sure if we want to do this or if there's more to do than just this. I also wasn't sure whether to put the IsClusterScoped field in input.Input (which I did) or if we should limit it to just scaffold.Role and scaffold.RoleBinding. Thoughts?

[estroz]

isClusterScoped is specific to Roles and RoleBindings so it shouldn't go in input.Config or scaffold.Scaffold. I suggest adding an IsClusterScoped field and setting it in both scaffold.Role and scaffold.RoleBinding here.

[lilic]

lgtm 👍

One suggestion is to maybe add some docs on the flag and link to some cluster scoped docs, just to explain that it exists and the use case for it, as currently we only mention it after the user creates the operator.

[lilic]

Nit but maybe this might make things a bit clearer:
Replace this with the namespace the operator is deployed in.

[shawn-hurley]

Quick question, but if a user tells us that their operator is cluster-wide, we probably want the WATCH_NAMESPACE in the deployment to be "" as well?

[estroz]

LGTM

[hasbro17]

Overall SGTM.
However I think we'll need to update the ansible user-guide as well for the steps of replacing the REPLACE_NAMESPACE for deploy/role_binding.yaml when cluster-scoped.
@shawn-hurley Can you double check what changes we need for the rbac setup in the ansible user-guide?
https://github.com/operator-framework/operator-sdk/blob/master/doc/ansible/user-guide.md#1-run-as-a-pod-inside-a-kubernetes-cluster

[joelanford]

Good catch. Those sections are nearly identical, so I copied over the cluster-scoped stuff into the ansible docs. I did a quick test by scaffolding new go and ansible operators with the --cluster-scoped flag and deployed them along with a couple of CRs in different namespaces and everything deployed as expected.