Generated aggregated cluster roles contains group id in resource name

[lulf]

I'm facing an issue I'm not sure is due to a bug in my CSV or an inconsistency in the CSV format. Basically my api service resource is defined like this:

    - containerPort: 8443
      deploymentName: api-server
      description: A group of messaging addresses that can be accessed via the same
        endpoint
      displayName: Address Space
      group: enmasse.io
      kind: AddressSpace
      name: addressspaces.enmasse.io

Notice the name has the group id at the end, which is the same as for CRDs. However, the generated clusterrole looks like this:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: 2019-02-27T12:08:24Z
  labels:
    olm.opgroup.permissions/aggregate-to-view: global-operators
    rbac.authorization.k8s.io/aggregate-to-view: "true"
  name: addressspaces.enmasse.io-v1beta1-view
  ownerReferences:
  - apiVersion: operators.coreos.com/v1alpha1
    blockOwnerDeletion: false
    controller: false
    kind: ClusterServiceVersion
    name: enmasse.0.27.0
    uid: 56e66e37-3a88-11e9-9dcb-06c33046a312
  resourceVersion: "32281"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterroles/addressspaces.enmasse.io-v1beta1-view
  uid: 62025220-3a88-11e9-9dcb-06c33046a312
rules:
- apiGroups:
  - enmasse.io
  resources:
  - addressspaces.enmasse.io
  verbs:
  - get
  - list
  - watch

As you can see the 'resources' contains the group id here as well, which prevents RBAC from working.

I will try to remove the group id for the name of the apiservice objects, which I expect will fix the issue. It would be good if:

• CRDs and apiservice objects had the same format for name
• operator-courier validates apiservice objects.

[ecordell]

I will try to remove the group id for the name of the apiservice objects, which I expect will fix the issue.

Doing this should generate the correct clusterroles.

CRDs and apiservice objects had the same format for name

Agreed - and we have issues in our backlog for cleaning up these APIs

[lulf]

This resolves the issue, thanks. Closing this as you already have this on your backlog.