feat: add NamespacedPolicy CRD [multi-tenancy PR 7]

[binbin-li]

Description

What this PR does / why we need it:

This is the 7th PR for multi-tenancy support. Please review #1395 first. Check diff between PR 6 and PR 7 at: binbin-li#123

1. Created new CRD: NamespacedPolicy for the namespaced Policy resource.
2. Added controller for the NamespacedPolicy and moved some common logics beween Policy Controller and Namespaced Policy Controller to util methods.
3. Updated the implementation of ActivePolicies so that it fully supports accessing Policies per namespace.
4. Will add new e2e tests for namespaced CRs once all CRDs supports namespace.

Which issue(s) this PR fixes (optional, using fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when the PR gets merged):

Fixes #

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Helm Chart Change (any edit/addition/update that is necessary for changes merged to the main branch)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Please also list any relevant details for your test configuration

• Test A
• Test B

Checklist:

• Does the affected code have corresponding tests?
• Are the changes documented, not just with inline documentation, but also with conceptual documentation such as an overview of a new feature, or task-based documentation like a tutorial? Consider if this change should be announced on your project blog.
• Does this introduce breaking changes that would require an announcement or bumping the major version?
• Do all new files have appropriate license header?

Post Merge Requirements

• MAINTAINERS: manually trigger the "Publish Package" workflow after merging any PR that indicates Helm Chart Change

[codecov]

Codecov Report

Attention: Patch coverage is 71.79487% with 33 lines in your changes are missing coverage. Please review.

❗ No coverage uploaded for pull request base (dev@ea5604a). Click here to learn what that means.

❗ Current head 8b67644 differs from pull request most recent head 5b77947. Consider uploading reports for the commit 5b77947 to get more accurate results

Files	Patch %	Lines
pkg/utils/test_utils.go	0.00%	22 Missing ⚠️
pkg/manager/manager.go	0.00%	7 Missing ⚠️
...controllers/namespaceresource/policy_controller.go	92.15%	4 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff           @@
##             dev    #1402   +/-   ##
======================================
  Coverage       ?   66.52%           
======================================
  Files          ?      114           
  Lines          ?     5987           
  Branches       ?        0           
======================================
  Hits           ?     3983           
  Misses         ?     1621           
  Partials       ?      383           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[susanshi]

thanks for the PR binbin, left some comments.

[susanshi]

Want to confirm the role here. Do we need a cluster role or role? is there a difference when rolebinding when it comes to ClusterScoped policy vs namespacedpolicy?

[binbin-li]

Good question! This is actually generated by kubebuilder command, and ClusterRole is always assigned to it. Since it's not actually used anywhere it does not make a difference. IMO, it's like a template for devs to follow in Helm template which could be updated accordingly.

[susanshi]

Hi Binbin, does this PR enable customer use Cluster store/verifier , with a name spaced policy? just wondering if we should highlight this scenario in a release note for v1.2

[binbin-li]

Hi Binbin, does this PR enable customer use Cluster store/verifier , with a name spaced policy? just wondering if we should highlight this scenario in a release note for v1.2

synced offline, will need to merge all following CRD PRs to enable multi-tenancy.

[susanshi]

LGTM