add cpfs.imagePullPrefix, remove nss roles (#2449)

* add cpfs.imagePullPrefix, remove nss roles

Signed-off-by: Ben Luzarraga <luzarragaben@gmail.com>

* add watch permissions to avoid noisy error message

Signed-off-by: Ben Luzarraga <luzarragaben@gmail.com>

---------

Signed-off-by: Ben Luzarraga <luzarragaben@gmail.com>

Author: bluzarraga

bedrock-migration/templates/bedrock-migration-job.yaml

@@ -12,7 +12,7 @@ spec:
     spec:
       containers:
       - name: bedrock-migration-job
-        image: {{ .Values.global.imagePullPrefix }}/{{ .Values.cpfs.imageRegistryNamespaceOperand }}/cpfs-utils:4.6.7
+        image: {{ .Values.cpfs.imagePullPrefix | default .Values.global.imagePullPrefix }}/{{ .Values.cpfs.imageRegistryNamespaceOperand }}/cpfs-utils:4.6.7
         command:
           - bash
           - -c
@@ -113,6 +113,9 @@ spec:
                 roles="${roles} $(oc get roles -n $ns | grep postgresql-operator-controller-manager | awk '{print $1}' | tr "\n" " ")"
                 roles="${roles} $(oc get roles -n $ns | grep cloud-native-postgresql | awk '{print $1}' | tr "\n" " ")"
                 roles="${roles} $(oc get roles -n $ns | grep common-service-db | awk '{print $1}' | tr "\n" " ")"
+
+                #get nss roles
+                roles="${roles} $(oc get roles -n $ns | grep nss-managed-role-from | awk '{print $1}' | tr "\n" " ")"
                 
                 if [[ $ns != $servicesNamespace ]]; then
                     edbSA=$(oc get sa -n $ns --ignore-not-found | grep postgresql-operator-controller-manager | awk '{print $1}' | tr "\n" " ")

bedrock-migration/templates/rbac.yaml

@@ -25,6 +25,7 @@ rules:
   - list
   - get
   - delete
+  - watch
 - apiGroups: 
   - "rbac.authorization.k8s.io"
   resources:
@@ -34,6 +35,7 @@ rules:
   - list
   - get
   - delete
+  - watch
 - apiGroups: 
   - ""
   resources:
@@ -44,6 +46,7 @@ rules:
   - list
   - get
   - delete
+  - watch
 - apiGroups: 
   - "batch"
   resources:
@@ -52,6 +55,7 @@ rules:
   - list
   - get
   - delete
+  - watch
 - apiGroups: 
   - "operator.ibm.com"
   resources:
@@ -61,6 +65,7 @@ rules:
   - get
   - delete
   - patch
+  - watch
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -102,6 +107,7 @@ rules:
   - list
   - get
   - delete
+  - watch
 - apiGroups: 
   - ""
   resources:
@@ -111,6 +117,7 @@ rules:
   - list
   - get
   - delete
+  - watch
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1