#295 broke handling multiple PulsarPermissions for PulsarTopic/PulsarNamespace

[piotr-bzdyl-vertexinc]

#295 changed pulsar permissions handling (https://github.com/streamnative/pulsar-resources-operator/pull/295/files#diff-7ee96543d0c11e11d8d8ab0f179e9c7721c36be1d82f051cc0999f00b067a936R155-R170): it authoritatively sets permissions according to currently reconciled PulsarPermission resource. This means it's impossible to specify more than one PulsarPermission resource targeting a single pulsar resource (topic or namespace). Due to current PulsarPermission.spec schema it makes impossible granting different set of permissions (actions) to different roles (e.g. granting consume action to consuming app role and produce action to producing app role).

[anosulchik]

We're seeing the same issue. Having two permissions with different actions specified for the same topic, only one ends up in pulsar. Example:

apiVersion: resource.streamnative.io/v1alpha1
kind: PulsarPermission
metadata:
  name: mi-apache-pulsar-load-test-vector-consumer-grant
  namespace: mi-apache-pulsar
spec:
  actions:
  - consume
  connectionRef:
    name: mi-apache-pulsar-staging-connection
  lifecyclePolicy: CleanUpAfterDeletion
  resourceName: persistent://mi/default/pulsar-load-test
  resourceType: topic
  roles:
  - system:serviceaccount:mi-apache-pulsar:mi-apache-pulsar-load-test-vector-consumer

apiVersion: resource.streamnative.io/v1alpha1
kind: PulsarPermission
metadata:
  name: mi-apache-pulsar-load-test-vector-producer-grant
  namespace: mi-apache-pulsar
spec:
  actions:
  - produce
  connectionRef:
    name: mi-apache-pulsar-staging-connection
  lifecyclePolicy: CleanUpAfterDeletion
  resourceName: persistent://mi/default/pulsar-load-test
  resourceType: topic
  roles:
  - system:serviceaccount:mi-apache-pulsar:mi-apache-pulsar-load-test-vector-producer

It results in the following permissions applied to above mentioned topic:

$ ./bin/pulsar-admin namespaces policies mi/default
{
  "auth_policies" : {
    ...
    "destination_auth" : {
      "persistent://mi/default/pulsar-load-test" : {
        "system:serviceaccount:mi-apache-pulsar:mi-apache-pulsar-load-test-vector-producer" : [ "produce" ]
      }
    }
  }

It should be:

$ ./bin/pulsar-admin namespaces policies mi/default
{
  "auth_policies" : {
    ...
    "destination_auth" : {
      "persistent://mi/default/pulsar-load-test" : {
        "system:serviceaccount:mi-apache-pulsar:mi-apache-pulsar-load-test-vector-consumer" : [ "consume" ],
        "system:serviceaccount:mi-apache-pulsar:mi-apache-pulsar-load-test-vector-producer" : [ "produce" ]
      }
    }
  }

[brunocascio]

I've just suggested to rollback this change because it breaks the permissions functionality.

It was released with 0.10.0, so technically prior versions should work fine