Add the ability to ignore cluster scoped resources.

[knutejohKLP]

These resources will generally be handled seperatly in a multitenant enviornment. This also gives the ability to control where the service account can create the configmaps, as clusterwide read/write on configmaps could be to broad access for security reasons.

Signed-off-by: Knut-Erik Johnsen knut-erik.johnsen@klp.no

[jetstack-bot]

Hi @knutejohKLP. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[knutejohKLP]

/cc @JoshVanL

[jetstack-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: knutejohKLP
To complete the pull request process, please assign joshvanl after the PR has been reviewed.
You can assign the PR to them by writing /assign @joshvanl in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[knutejohKLP]

/cc @SgtCoDFish

[SgtCoDFish]

/ok-to-test

[SgtCoDFish]

Hey, I'm sorry but I don't have the bandwidth to review this right now. I'll raise it with the other maintainers and hopefully someone can take a look!

[munnerz]

Does this actually work? istio-csr requires the ability to perform a TokenReview... so by not granting this permission, it surely won't be able to do anything?

[knutejohKLP]

The idea here is that the deployments on the cluster level, the role and the rolebinding, could be handled outside of this deployment. We are running multiple deployments of istio and istio-csr in our clusters, but these resources can only be set once, so we can't use the helmtemplates as they are right now. For a single deployment, this should always be created, which is why the default is false on the setting.

[munnerz]

For this namespaced approach, you are still going to need to grant these permissions on a per namespace basis right? So keeping this ClusterRole would allow users to create namespace-scoped RoleBindings in each namespace that they want enabling for istio-csr use.

Is there a reason to not deploy the ClusterRole? Otherwise this will lead to 1) duplicated resources (everyone needs to create a RoleBinding in every namespace) and 2) uncertainty, as users won't know what permissions to grant in those Roles.

[knutejohKLP]

If we leave the clusterrole, we can't use the helm charts for more than one deployment, as they will get the same name. The deployments will complain about resources that already exists. The idea is that anything on the clusterlevel is handled outside of this helm chart when running in a multitenant setup. and that the helm charts focus on a single namespace.

[knutejohKLP]

Any more feedback on this issue?

[inteon]

/retest

[jetstack-bot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jetstack-bot]

@knutejohKLP: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cert-manager-istio-csr-k8s-v1-26-istio-v1-19	d69cf93	link	true	/test pull-cert-manager-istio-csr-k8s-v1-26-istio-v1-19
pull-cert-manager-istio-csr-k8s-v1-29-istio-v1-20	d69cf93	link	true	/test pull-cert-manager-istio-csr-k8s-v1-29-istio-v1-20
pull-cert-manager-istio-csr-k8s-v1-26-istio-v1-18	d69cf93	link	true	/test pull-cert-manager-istio-csr-k8s-v1-26-istio-v1-18
pull-cert-manager-istio-csr-test-ecc	d69cf93	link	true	/test pull-cert-manager-istio-csr-test-ecc

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.