Cluster scope operator (ClusterRole and ClusterRoleBinding) support about build

[zhangtbj]

Also FYI @sbose78 :)

[sbose78]

@zhangtbj Thanks!

If the WATCH_NAMESPACE is set to "", the operator should be able to watch CRs in all namespaces with Role,RoleBinding..

What do you think? Though I need to check how that's going to work with cluster-scoped CRDs.

[zhangtbj]

Hi @sbose78 ,

I took a look other operators in openshift repo, such as:
https://github.com/openshift/cluster-monitoring-operator/blob/master/manifests/0000_50_cluster_monitoring_operator_02-role.yaml
or
https://github.com/openshift/cluster-image-registry-operator/blob/master/manifests/02-rbac.yaml#L2

They all use ClusterRole and ClusterRoleBinding

And I think although change WATCH_NAMESPACE is set to "", there will be the permission issues that the role cannot operate the resources from cluster scope like the above error message.

[zhangtbj]

Hi @sbose78 ,

It is an important requirement for us that we need to run the operator at cluster scope to handle the build for all of namespaces.

I provided a PR and verified in my env, could you review and see if it is acceptable for the current design:
#68

Thanks!

[zhangtbj]

The PR is merged, thanks a lot!

[sbose78]

I realized we need this anyway since we now have a cluster-scoped CRD 🥇