Move Initial RBAC Reconcile Attempt

The first RBAC reconciliation is now attempted when a controller group is
first created, immediately giving the Operator an opportunity to create
it's own RBAC within a target namespace if it has the ability to do so,
e.g. when using the "dynamic" namespace operating mode

Author: andrewlecuyer

controller/manager/controllermanager.go

@@ -369,6 +369,27 @@ func (c *ControllerManager) addControllerGroup(namespace string) error {
 
 	log.Debugf("Controller Manager: added controller group for namespace %s", namespace)
 
+	// check if we can create RBAC in the namespace in order to the reconcile RBAC
+	// as needed to ensure proper operator functionality.  If we can't reconcile at this point
+	// we will try again on the next namespace refresh interval.
+	canCreateRBACInNamespace, err := ns.CanCreateRBACInNamespace(
+		c.controllers[namespace].kubeClientset,
+		namespace, c.namespaceOperatingMode)
+	if err != nil {
+		return err
+	}
+
+	log.Debugf("Controller Manager: canCreateRBACInNamespace is '%t' for namespace %s",
+		canCreateRBACInNamespace, namespace)
+
+	// now reconcile RBAC in the namespace if allowed
+	if canCreateRBACInNamespace {
+		if err := ns.ReconcileTargetRBAC(c.controllers[namespace].kubeClientset, c.pgoNamespace,
+			namespace); err != nil {
+			return err
+		}
+	}
+
 	return nil
 }
 
@@ -481,26 +502,6 @@ func (c *ControllerManager) runControllerGroup(namespace string) error {
 			"refresh interval", namespace)
 	}
 
-	// check if we can create RBAC in the namespace in order to the reconcile RBAC
-	// as needed to ensure proper operator functionality
-	canCreateRBACInNamespace, err := ns.CanCreateRBACInNamespace(
-		c.controllers[namespace].kubeClientset,
-		namespace, c.namespaceOperatingMode)
-	if err != nil {
-		return err
-	}
-
-	log.Debugf("Controller Manager: canCreateRBACInNamespace is '%t' for namespace %s",
-		canCreateRBACInNamespace, namespace)
-
-	// now reconcile RBAC in the namespace if allowed
-	if canCreateRBACInNamespace {
-		if err := ns.ReconcileTargetRBAC(c.controllers[namespace].kubeClientset, c.pgoNamespace,
-			namespace); err != nil {
-			return err
-		}
-	}
-
 	controllerGroup.kubeInformerFactory.Start(controllerGroup.stopCh)
 	controllerGroup.pgoInformerFactory.Start(controllerGroup.stopCh)
 	controllerGroup.kubeInformerFactoryWithRefresh.Start(controllerGroup.stopCh)