Add metrics role and extend view role

[svor]

Signed-off-by: svor vsvydenk@redhat.com

What does this PR do?

• Adds new verb get with " " APIGroups to get an information about limited resources
• Adds new APIGroups metrics.k8s.io to get an information from Metric server

What issues does this PR fix or reference?

eclipse-che/che#17205

[openshift-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[svor]

Minishift / Testing latest changes (pull_request) check should be passed after applying these changes: https://github.com/eclipse/che-operator/pull/519/files#diff-dd2b7f73672812f28eaeefd88568f005bc349b4647e015a36b2789ad29b5221fL89

[ericwill]

I'm out of my element here, so will defer to a subject matter expert's judgement 😃

[tolusha]

@svor
To have all tests passed:

• cherry pick Update minishift nightly tests #524 once it is merged.
• also wait until this PR is merged prepare operator namespace cluster-role #520

[tolusha]

pls. create a new function in role.go

SyncExecRoleToCluster(..)

and move

execPolicyRule := []rbac.PolicyRule{
		{
			APIGroups: []string{
				"",
			},
			Resources: []string{
				"pods/exec",
			},
			Verbs:     []string{
				"*",
			},
		},
	}
	role, err := deploy.SyncRoleToCluster(deployContext, "exec", execPolicyRule)

Pls. do accordingly for other changes...

[svor]

Updated. @tolusha could you pls take another look
Also still have some problems with Check nightly "opm" bundle action. From the logs i see a message:

Nightly bundle file deploy/olm-catalog/eclipse-che-preview-kubernetes/manifests/che-operator.clusterserviceversion.yaml should be updated in your pr

but che-operator/olm/update-nightly-bundle.sh script doesn't provide any updates.

[tolusha]

Pls. create a corresponding function in role.go

[tolusha]

use the const
https://github.com/svor/che-operator/blob/sv/metrics/pkg/deploy/tls.go#L39

[tolusha]

Let's wait for PR check passed

[AndrienkoAleksandr]

Hello, @svor take a look, please, one more thing: update roles. For example user could have installed Che, and operator installs role with new 'verb'. In the our current code, this role won't be updated: https://github.com/eclipse/che-operator/blob/4c194ddeb57e0717b8de7083efdf40cd43634a93/pkg/deploy/role.go#L42 and https://github.com/eclipse/che-operator/blob/4c194ddeb57e0717b8de7083efdf40cd43634a93/pkg/deploy/role.go#L48 . So you need apply differ to compare roles, and if role was changed(for newer Che we want more permissions), then we should update role. We have a good examples in the code how to do that.
Example: here was evaluated diff between pvc https://github.com/eclipse/che-operator/blob/4c194ddeb57e0717b8de7083efdf40cd43634a93/pkg/deploy/pvc.go#L71 and if pvc is differ, then we make update:
https://github.com/eclipse/che-operator/blob/4c194ddeb57e0717b8de7083efdf40cd43634a93/pkg/deploy/pvc.go#L76
The same thing you should do for role object to prevent update issue.

[tolusha]

Pls fix @AndrienkoAleksandr 's remarks

[svor]

@AndrienkoAleksandr Thank you for detailed explanation, your remark makes sense 100%! I'll update this PR

[svor]

View Role was updated successfully in my local k8s environment. Logs from che-operator pod:

time="2020-11-20T15:54:20Z" level=info msg="Updating existed object: Role, name: view"
Difference:
  &v1.Role{
  	... // 2 ignored fields
  	Rules: []v1.PolicyRule{
  		{
  			Verbs: []string{
  				"list",
+ 				"get",
  			},
  			APIGroups: []string{""},
  			Resources: []string{"pods"},
  			... // 2 ignored fields
  		},
+ 		{
+ 			Verbs:     []string{"list", "get", "watch"},
+ 			APIGroups: []string{"metrics.k8s.io"},
+ 			Resources: []string{"pods"},
+ 		},
  	},
  }

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: AndrienkoAleksandr, svor, tolusha
To complete the pull request process, please assign after the PR has been reviewed.
You can assign the PR to them by writing /assign in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment