Add rbac for deploying hostedclusters and nodepools

[sakhoury]

No description provided.

[sakhoury]

/approve cancel

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign carbonin for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[carbonin]

This is interesting ... We don't have default templates that reference these types, but we're adding the RBAC here.

Would it be better to draw the line between resources included in the default templates and those not?

i.e. If users are asking the controller to create resources that it doesn't ship default templates for then they should also add this rbac to the controller's SA manually.

What do you think?

[sakhoury]

This is interesting ... We don't have default templates that reference these types, but we're adding the RBAC here.

Would it be better to draw the line between resources included in the default templates and those not?

i.e. If users are asking the controller to create resources that it doesn't ship default templates for then they should also add this rbac to the controller's SA manually.

What do you think?

That's a very sound argument! I think we briefly touched on the topic of adding rbacs for standard OpenShift deployment resources. However, it makes sense to only provide rbacs for resources the controller supports through default templates. Let's discuss this in our sync-up meeting.

[openshift-merge-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[sakhoury]

Closing pull-request as RBACs should be added by user for new resources.