fix: split EPP RBAC into cluster and namespaced scoped permission

[chewong]

Fixes #224

Testing:

helm upgrade -i epp ./config/charts/inferencepool

# in a curl pod
curl 10.0.227.159/v1/models
{"object":"list","data":[{"id":"...

Split EPP RBAC into cluster and namespaced scoped permission

[netlify]

✅ Deploy Preview for gateway-api-inference-extension ready!

Name	Link
🔨 Latest commit	6524475
🔍 Latest deploy log	https://app.netlify.com/projects/gateway-api-inference-extension/deploys/68893226f1f2bd0008d947b7
😎 Deploy Preview	https://deploy-preview-1071--gateway-api-inference-extension.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[nirrozenbaum]

thanks for the PR 👍 .

can you update also here and here?

[danehans]

I think the test utils/suite need to be updated too:

$ grep -ri ClusterRole .
./config/charts/inferencepool/templates/rbac.yaml:kind: ClusterRole
./config/charts/inferencepool/templates/rbac.yaml:kind: ClusterRoleBinding
./config/charts/inferencepool/templates/rbac.yaml:  kind: ClusterRole
./config/manifests/inferencepool-resources.yaml:kind: ClusterRole
./config/manifests/inferencepool-resources.yaml:kind: ClusterRoleBinding
./config/manifests/inferencepool-resources.yaml:  kind: ClusterRole
./test/testdata/metrics-rbac.yaml:kind: ClusterRole
./test/testdata/metrics-rbac.yaml:kind: ClusterRoleBinding
./test/testdata/metrics-rbac.yaml:  kind: ClusterRole
./test/testdata/inferencepool-e2e.yaml:kind: ClusterRole
./test/testdata/inferencepool-e2e.yaml:kind: ClusterRoleBinding
./test/testdata/inferencepool-e2e.yaml:  kind: ClusterRole
./test/e2e/epp/e2e_suite_test.go:	// Wait for the clusterrole to exist.
./test/e2e/epp/e2e_suite_test.go:		return k8sClient.Get(ctx, types.NamespacedName{Name: "pod-read"}, &rbacv1.ClusterRole{})
./test/e2e/epp/e2e_suite_test.go:	// Wait for the clusterrolebinding to exist.
./test/e2e/epp/e2e_suite_test.go:		return k8sClient.Get(ctx, types.NamespacedName{Name: "pod-read-binding"}, &rbacv1.ClusterRoleBinding{})
./test/utils/utils.go:	binding := &rbacv1.ClusterRoleBinding{
./test/utils/utils.go:	role := &rbacv1.ClusterRole{
./test/utils/utils.go:	metricsReaderBinding := &rbacv1.ClusterRoleBinding{
./test/utils/utils.go:	metricsReaderRole := &rbacv1.ClusterRole{
./Makefile:manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
...
./site-src/guides/metrics-and-observability.md:To scrape metrics, the client needs a ClusterRole with the following rule:
./site-src/guides/metrics-and-observability.md:kind: ClusterRole
./site-src/guides/metrics-and-observability.md:kind: ClusterRoleBinding
./site-src/guides/metrics-and-observability.md:  kind: ClusterRole
...

[danehans]

This will be a breaking change for implementations. @nirrozenbaum @kfswain @ahg-g we need a way to ensure breaking changes are highlighted when a release is cut.

[danehans]

nit: Update comment from "ClusterRole" to "Role" or "RBAC":

./Makefile:manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.

/lgtm

[danehans]

/lgtm

[nirrozenbaum]

This will be a breaking change for implementations. @nirrozenbaum @kfswain @ahg-g we need a way to ensure breaking changes are highlighted when a release is cut.

how about adding a label (gie-area/breaking-change) and label the PR. then add instructions to whoever is doing the release to go over the list of PRs and highlight what's needed?

[kfswain]

This will be a breaking change for implementations. @nirrozenbaum @kfswain @ahg-g we need a way to ensure breaking changes are highlighted when a release is cut.

how about adding a label (gie-area/breaking-change) and label the PR. then add instructions to whoever is doing the release to go over the list of PRs and highlight what's needed?

We could also tag breaking PRs in a comment on the release tracking issue/milestone

[chewong]

Raised a PR in test-infra to create a new label called kind/breaking-change - kubernetes/test-infra#35069

[ahg-g]

anything pending on merging this PR?

[chewong]

Added release note in the PR description. Nothing pending on merging this PR.

[chewong]

@ahg-g @nirrozenbaum could you take another look?

[ahg-g]

/lgtm
/approve
/hold cancel

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ahg-g, chewong

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ahg-g]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[nirrozenbaum]

just making sure, was the helm chart tested and verified it's working?

[chewong]

I tested it again and encountered some issues. Opened #1274 to fix them.