Update lease access check to account for lease name and multiple rules

[MikeEdgar]

Allow the verbs required for lease access to be split between multiple rules and exclude rules that name a non-matching lease name. This allows rules such as those below to work as expected.

rules:
  - apiGroups:
      - coordination.k8s.io
    resources:
      # The "create" verb cannot be used with "resourceNames"
      - leases
    verbs:
      - create
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    resourceNames:
      - my-lease
    verbs:
      - get
      - list
      - watch
      - delete
      - patch
      - update

[metacosm]

It would be better to not use Optional here but pass the object directly and use Optional.ofNullable when resolving the kubernetes client instead.

[MikeEdgar]

I've updated how Optional is used for the mock client - let me know if it's not what you had in mind.

[csviri]

Hi @MikeEdgar thx for the PR,

pls run mvn clean install to format the code.

[csviri]

The integration test: LeaderElectionChangeNamespaceIT is also failing, could you pls take a look why? later also I can take a look

[MikeEdgar]

The integration test: LeaderElectionChangeNamespaceIT is also failing, could you pls take a look why? later also I can take a look

Thanks, I'll take a look today.

[MikeEdgar]

The integration test: LeaderElectionChangeNamespaceIT is also failing, could you pls take a look why? later also I can take a look

Thanks, I'll take a look today.

The rule filter predicate on main has incorrect grouping that I didn't notice before, that was fixed with the changes. The filter is picking any rule that has the universal/wildcard verb. I'll fix the test in this PR to deploy/remove a role/binding.

java-operator-sdk/operator-framework-core/src/main/java/io/javaoperatorsdk/operator/LeaderElectionManager.java

Lines 134 to 138 in 8f77f68

	var foundRule = reviewResult.getStatus().getResourceRules().stream()
	.filter(rule -> rule.getApiGroups().contains(COORDINATION_GROUP)
	&& rule.getResources().contains(LEASES_RESOURCE)
	&& (rule.getVerbs().containsAll(verbs)) || rule.getVerbs().contains(UNIVERSAL_VERB))
	.findAny();

[MikeEdgar]

The permission check now tests for wildcard * for the API group and resource kinds.

[csviri]

LGMT!

Thank you!