Allow overriding rbac permissions in KubernetesClientProcessor

[jmrodri]

Description

The rbac generated by the kubernetes-extension only adds the view role. The documentation does mention that you have to manually edit this, but this is less than optimal when you are trying to automate building an operator.

We're currently building a scaffolder to integrate with the Operator Framework Operator SDK and Quarkus. When the user runs mvn install we get incorrect rbac as view is not enough for an Operator. I've looked into adding kustomize but that seems out of place for this project.

So being able to specify the roles we need a more advanced rbac mechanism, here is the sample we generate for the Go sample operators: https://github.com/operator-framework/operator-sdk/tree/master/testdata/go/v3/memcached-operator/config/rbac

Implementation ideas

No response

[quarkus-bot]

/cc @geoand

[geoand]

cc @iocanel

[geoand]

Can you expand a little on what exactly you would like to see?

[jmrodri]

@geoand @iocanel today only a view role is generated and I don't see any way to customize it to generate different rbac rules. I would want to create something like the sample below without having the user edit it by hand. Are there any annotations or application.properties we could set to allow for a more complex rbac.yaml to be generated?

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: manager-role
rules:
- apiGroups:
  - apps
  resources:
  - deployments
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - cache.example.com
  resources:
  - memcacheds
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - cache.example.com
  resources:
  - memcacheds/finalizers
  verbs:
  - update
- apiGroups:
  - cache.example.com
  resources:
  - memcacheds/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch

[jmrodri]

Or even something I can pass to the mvn command mvn package -D quarkus.rbac.verbs=get,patch,update -D quarkus.rbac.resources.... The other thing I'm considering is post processing the file after the fact.

[geoand]

@iocanel is this something you plan to look into?