Add special handling for Aggregatin ClusterRole

[lburgazzoli]

Description

For ClusterRole, if AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller. This also happen if the rules are set to an empty slice or nil. This commit add a special handling for the ClusterRole resource so that the rules filed is removed in case aggregation is configured.

How Has This Been Tested?

1. Enable KServe
2. Watch for a ClusterRole named kserve-admin
3. if a reconcile kicks in i.e. because KServe pods are deleted, then the ClusterRole named kserve-admin should not receive updates

Screenshot or short clip

Merge criteria

• You have read the contributors guide.
• Commit messages are meaningful - have a clear and concise summary and detailed explanation of what was changed and why.
• Pull Request contains a description of the solution, a link to the JIRA issue, and to any dependent or related Pull Request.
• Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
• The developer has manually tested the changes and verified that the changes work

[lburgazzoli]

@grdryn added this special handling for ClusterRoles so there should not be any ping-pong anymore

[zdtsw]

@grdryn added this special handling for ClusterRoles so there should not be any ping-pong anymore

so Owns(&rbacv1.ClusterRole{}, reconciler.WithPredicates(clusterrole.IgnoreIfAggregationRule())). is to prevernt the whole reconcile gets called,
this PR is for if reconcile gets called it should not act on these rules
right?

[lburgazzoli]

@grdryn added this special handling for ClusterRoles so there should not be any ping-pong anymore

this PR is for if reconcile gets called it should not act on these rules right?

This is to reduce chattering so upon the deployment of a cluster roles, then we don't overrides the rules if the cluster role is an aggregating one because that would cause k8s controllers to reset it back and would invalidate the deployment cache. So eve if we are not triggering a reconcile because of the predicate, then if for whatever reason a reconcile would kicks in, then it would cause the cluster role to be re-deployed as the cache would have been invalidated for that specific resource ... which then get reverted again by the k8s controller, and again and again :)

[grdryn]

/lgtm

Thanks!

[codecov]

Codecov Report

Attention: Patch coverage is 75.00000% with 3 lines in your changes missing coverage. Please review.

Please upload report for BASE (feature-operator-refactor@64c7ea7). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
pkg/controller/actions/deploy/action_deploy.go	75.00%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@                     Coverage Diff                      @@
##             feature-operator-refactor    #1407   +/-   ##
============================================================
  Coverage                             ?   27.32%           
============================================================
  Files                                ?       61           
  Lines                                ?     4901           
  Branches                             ?        0           
============================================================
  Hits                                 ?     1339           
  Misses                               ?     3406           
  Partials                             ?      156           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: zdtsw

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [zdtsw]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment