fix: split EPP RBAC into cluster and namespaced scoped permission

[chewong]

Fixes #224

Testing:

helm upgrade -i epp ./config/charts/inferencepool

# in a curl pod
curl 10.0.227.159/v1/models
{"object":"list","data":[{"id":"...

Split EPP RBAC into cluster and namespaced scoped permission

[netlify]

✅ Deploy Preview for gateway-api-inference-extension ready!

Name	Link
🔨 Latest commit	b77dcea
🔍 Latest deploy log	https://app.netlify.com/projects/gateway-api-inference-extension/deploys/6876aa9b8168f300088d651c
😎 Deploy Preview	https://deploy-preview-1071--gateway-api-inference-extension.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[nirrozenbaum]

thanks for the PR 👍 .

can you update also here and here?

[danehans]

I think the test utils/suite need to be updated too:

$ grep -ri ClusterRole .
./config/charts/inferencepool/templates/rbac.yaml:kind: ClusterRole
./config/charts/inferencepool/templates/rbac.yaml:kind: ClusterRoleBinding
./config/charts/inferencepool/templates/rbac.yaml:  kind: ClusterRole
./config/manifests/inferencepool-resources.yaml:kind: ClusterRole
./config/manifests/inferencepool-resources.yaml:kind: ClusterRoleBinding
./config/manifests/inferencepool-resources.yaml:  kind: ClusterRole
./test/testdata/metrics-rbac.yaml:kind: ClusterRole
./test/testdata/metrics-rbac.yaml:kind: ClusterRoleBinding
./test/testdata/metrics-rbac.yaml:  kind: ClusterRole
./test/testdata/inferencepool-e2e.yaml:kind: ClusterRole
./test/testdata/inferencepool-e2e.yaml:kind: ClusterRoleBinding
./test/testdata/inferencepool-e2e.yaml:  kind: ClusterRole
./test/e2e/epp/e2e_suite_test.go:	// Wait for the clusterrole to exist.
./test/e2e/epp/e2e_suite_test.go:		return k8sClient.Get(ctx, types.NamespacedName{Name: "pod-read"}, &rbacv1.ClusterRole{})
./test/e2e/epp/e2e_suite_test.go:	// Wait for the clusterrolebinding to exist.
./test/e2e/epp/e2e_suite_test.go:		return k8sClient.Get(ctx, types.NamespacedName{Name: "pod-read-binding"}, &rbacv1.ClusterRoleBinding{})
./test/utils/utils.go:	binding := &rbacv1.ClusterRoleBinding{
./test/utils/utils.go:	role := &rbacv1.ClusterRole{
./test/utils/utils.go:	metricsReaderBinding := &rbacv1.ClusterRoleBinding{
./test/utils/utils.go:	metricsReaderRole := &rbacv1.ClusterRole{
./Makefile:manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
...
./site-src/guides/metrics-and-observability.md:To scrape metrics, the client needs a ClusterRole with the following rule:
./site-src/guides/metrics-and-observability.md:kind: ClusterRole
./site-src/guides/metrics-and-observability.md:kind: ClusterRoleBinding
./site-src/guides/metrics-and-observability.md:  kind: ClusterRole
...

[danehans]

This will be a breaking change for implementations. @nirrozenbaum @kfswain @ahg-g we need a way to ensure breaking changes are highlighted when a release is cut.

[danehans]

nit: Update comment from "ClusterRole" to "Role" or "RBAC":

./Makefile:manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: chewong
Once this PR has been reviewed and has the lgtm label, please ask for approval from danehans. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[danehans]

/lgtm

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[nirrozenbaum]

This will be a breaking change for implementations. @nirrozenbaum @kfswain @ahg-g we need a way to ensure breaking changes are highlighted when a release is cut.

how about adding a label (gie-area/breaking-change) and label the PR. then add instructions to whoever is doing the release to go over the list of PRs and highlight what's needed?

[kfswain]

This will be a breaking change for implementations. @nirrozenbaum @kfswain @ahg-g we need a way to ensure breaking changes are highlighted when a release is cut.

how about adding a label (gie-area/breaking-change) and label the PR. then add instructions to whoever is doing the release to go over the list of PRs and highlight what's needed?

We could also tag breaking PRs in a comment on the release tracking issue/milestone

[chewong]

Raised a PR in test-infra to create a new label called kind/breaking-change - kubernetes/test-infra#35069

[ahg-g]

anything pending on merging this PR?

[chewong]

Added release note in the PR description. Nothing pending on merging this PR.