fix: remove ServiceAccount binding to the edit role

[VanillaSpoon]

Issue link

closes #161

What changes have been made

In the current setup, we have a clusterrolebinding between the ServiceAccount and the default edit ClusterRole. The edit role provides an expansive set of permissions which have been checked and deemed not necessary for the operators functionality.

Therefor this PR removes the clusterrolebinding.

Checks

• I've made sure the tests are passing.
• Testing Strategy
  • Unit tests
  • Manual tests
  • Testing is not required for this change

[VanillaSpoon]

Hey @astefanutti
I believe the e2e here is failing due to a timeout from CODEFLARE_TEST_TIMEOUT_MEDIUM. Would there be any solution recommendations towards this, or would increasing the timeout wait suffice?

[sutaakar]

@VanillaSpoon There is an error logged in operator pod:

E1003 15:07:58.460889       1 queuejob_controller_ex.go:2097] Failed to delete resources associated with app wrapper: 'test-ns-tcbrs/mnist', err 1 error occurred:
	* jobs.batch is forbidden: User "system:serviceaccount:openshift-operators:codeflare-operator-controller-manager" cannot list resource "jobs" in API group "batch" at the cluster scope

That is probably the reason for the test failure.

[astefanutti]

@VanillaSpoon There is an error logged in operator pod:

E1003 15:07:58.460889       1 queuejob_controller_ex.go:2097] Failed to delete resources associated with app wrapper: 'test-ns-tcbrs/mnist', err 1 error occurred:
	* jobs.batch is forbidden: User "system:serviceaccount:openshift-operators:codeflare-operator-controller-manager" cannot list resource "jobs" in API group "batch" at the cluster scope

That is probably the reason for the test failure.

@VanillaSpoon @sutaakar I'd suggest we add permissions for batch Job resources to the default operator role.

[VanillaSpoon]

I appreciate the support on this @astefanutti and @sutaakar.

The changes have been updated in 9762026

[sutaakar]

/lgtm

[astefanutti]

While that works, MCAD should theoretically also be able to update these resources, so I'd suggest to add the following verbs for consistency:

- patch
- update
- watch

[VanillaSpoon]

Thanks @astefanutti :) I have applied the update in aa18a41

[astefanutti]

/lgtm

[astefanutti]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: astefanutti

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [astefanutti]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[astefanutti]

Thanks a lot @VanillaSpoon, that's a critical fix w.r.t. security.