Move read permissions for ingressclasses.networking.k8s.io to ClusterRole

`IngressClass` is a cluster-scoped resource, so granting read
permissions to the ServiceAccount in a namespaced role and rolebinding
isn't sufficient.

This commit changes the logic to generate a ClusterRole and
ClusterRoleBinding which allow the SA to `get/list/watch` `IngressClass`
resources.

Fixes #41

Author: simu

component/cluster.libsonnet

@@ -76,19 +76,6 @@ local cluster = function(name, options)
           'watch',
         ],
       },
-      {
-        apiGroups: [
-          'networking.k8s.io',
-        ],
-        resources: [
-          'ingressclasses',
-        ],
-        verbs: [
-          'get',
-          'list',
-          'watch',
-        ],
-      },
       {
         apiGroups: [
           'apps',
@@ -127,6 +114,28 @@ local cluster = function(name, options)
     roleRef_: role,
   };
 
+  local clusterRole = kube.ClusterRole('syn-vcluster-%s' % [ name ]) {
+    rules: [
+      {
+        apiGroups: [
+          'networking.k8s.io',
+        ],
+        resources: [
+          'ingressclasses',
+        ],
+        verbs: [
+          'get',
+          'list',
+          'watch',
+        ],
+      },
+    ],
+  };
+  local clusterRoleBinding = kube.ClusterRoleBinding('syn-vcluster-%s' % [ name ]) {
+    subjects_: [ sa ],
+    roleRef_: clusterRole,
+  };
+
   local service = kube.Service(name) {
     metadata+: {
       namespace: options.namespace,
@@ -408,6 +417,8 @@ local cluster = function(name, options)
     sa,
     role,
     roleBinding,
+    clusterRole,
+    clusterRoleBinding,
     service,
     headlessService,
     statefulSet,

tests/golden/defaults/defaults/defaults/10_cluster.yaml

@@ -57,14 +57,6 @@ rules:
       - get
       - list
       - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
   - apiGroups:
       - apps
     resources:
@@ -93,6 +85,39 @@ subjects:
     name: vc-defaults
     namespace: syn-defaults
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    name: syn-vcluster-defaults
+  name: syn-vcluster-defaults
+rules:
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingressclasses
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  annotations: {}
+  labels:
+    name: syn-vcluster-defaults
+  name: syn-vcluster-defaults
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: syn-vcluster-defaults
+subjects:
+  - kind: ServiceAccount
+    name: vc-defaults
+    namespace: syn-defaults
+---
 apiVersion: v1
 kind: Service
 metadata:

tests/golden/oidc/oidc/oidc/10_cluster.yaml

@@ -57,14 +57,6 @@ rules:
       - get
       - list
       - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
   - apiGroups:
       - apps
     resources:
@@ -93,6 +85,39 @@ subjects:
     name: vc-oidc
     namespace: testns
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    name: syn-vcluster-oidc
+  name: syn-vcluster-oidc
+rules:
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingressclasses
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  annotations: {}
+  labels:
+    name: syn-vcluster-oidc
+  name: syn-vcluster-oidc
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: syn-vcluster-oidc
+subjects:
+  - kind: ServiceAccount
+    name: vc-oidc
+    namespace: testns
+---
 apiVersion: v1
 kind: Service
 metadata:

tests/golden/openshift/openshift/openshift/10_cluster.yaml

@@ -57,14 +57,6 @@ rules:
       - get
       - list
       - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
   - apiGroups:
       - apps
     resources:
@@ -99,6 +91,39 @@ subjects:
     name: vc-openshift
     namespace: syn-openshift
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    name: syn-vcluster-openshift
+  name: syn-vcluster-openshift
+rules:
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingressclasses
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  annotations: {}
+  labels:
+    name: syn-vcluster-openshift
+  name: syn-vcluster-openshift
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: syn-vcluster-openshift
+subjects:
+  - kind: ServiceAccount
+    name: vc-openshift
+    namespace: syn-openshift
+---
 apiVersion: v1
 kind: Service
 metadata: