Simplify install

[mxyng]

• Follow Kubernetes recommended labels as defined here
• Make use of standard helper functions
  • Mostly for name and labels but this practice will make subchart easier
• Remove some unused RBAC related things from the engine
  • An engine Role shouldn't be necessary anymore since the engine is no longer being accessed through the proxy
  • Remove most rules from engine ClusterRole which has been briefly tested so it's possible some are still needed
    • user|group impersonate
    • pods list
    • services get
    • ingresses list
    • namespaces list

Implement #465

[jmorganca]

This is a nice cleanup

I do think we need:

• impersonate – users & groups
• list – pods

[BruceMacD]

I think we still need services and pods too:

services, err := clientset.CoreV1().Services(namespace).List(context.TODO(), metav1.ListOptions{
    LabelSelector: "app.kubernetes.io/instance=infra-engine",
})

componentPods, err := clientset.CoreV1().Pods("kube-system").List(context.TODO(), metav1.ListOptions{
    LabelSelector: "component=kube-controller-manager",
})

[jmorganca]

Yep! Add list - services to that list

[mxyng]

services list is still part of the role; only services get was removed. Will add back users|groups impersonate and pods list

[jmorganca]

This is great stuff! What would the new README.md look like? Should we include docs in this update?

[BruceMacD]

I think we still need services and pods too:

services, err := clientset.CoreV1().Services(namespace).List(context.TODO(), metav1.ListOptions{
    LabelSelector: "app.kubernetes.io/instance=infra-engine",
})

componentPods, err := clientset.CoreV1().Pods("kube-system").List(context.TODO(), metav1.ListOptions{
    LabelSelector: "component=kube-controller-manager",
})

[BruceMacD]

Should we be more descriptive in the name of this role still?

[mxyng]

I think that depends on if we expect to add more roles for the registry. IMO keeping it simple and consistent produces the best experience for the user, i.e. if they want to know what permission infra-registry has, they can get the role without first looking up what the role is called.

[mxyng]

This is great stuff! What would the new README.md look like? Should we include docs in this update?

The omni chart is still a work in progress and I've split it off into a separate PR so this shouldn't require any README.md changes