CNF-12792:nto: add configmaps/finalizers under operator Role

[Tal-or]

What this PR does / why we need it:
NTO is watching for the ConfigMap that encpasulets the PerformanceProfile and creates different components based on the given profile.

We should block the PerformanceProfile deletion as long as the dependent components exist.

For that NTO needs access the finalizers of the ConfigMap.

We should also update the control plane operator since
it's its responsibility to update NTO's role.

Which issue(s) this PR fixes
Fixes # CNF-11559

[sjenning]

This needs to be added to the control-plane-operator role as well.

failed to update control plane: failed to reconcile cluster node tuning operator: failed to reconcile cluster node tuning operator role: roles.rbac.authorization.k8s.io \"cluster-node-tuning-operator\" is forbidden: user \"system:serviceaccount:e2e-clusters-5526g-example-tm6z7:control-plane-operator\" (groups=[\"system:serviceaccounts\" \"system:serviceaccounts:e2e-clusters-5526g-example-tm6z7\" \"system:authenticated\"]) is attempting to grant RBAC permissions not currently held:\n{APIGroups:[\"\"], Resources:[\"configmaps/finalizers\"], Verbs:[\"*\"]}"

[Tal-or]

This needs to be added to the control-plane-operator role as well.

failed to update control plane: failed to reconcile cluster node tuning operator: failed to reconcile cluster node tuning operator role: roles.rbac.authorization.k8s.io \"cluster-node-tuning-operator\" is forbidden: user \"system:serviceaccount:e2e-clusters-5526g-example-tm6z7:control-plane-operator\" (groups=[\"system:serviceaccounts\" \"system:serviceaccounts:e2e-clusters-5526g-example-tm6z7\" \"system:authenticated\"]) is attempting to grant RBAC permissions not currently held:\n{APIGroups:[\"\"], Resources:[\"configmaps/finalizers\"], Verbs:[\"*\"]}"

Thank you @sjenning updated as requested PTAL

[netlify]

✅ Deploy Preview for hypershift-docs ready!

Name	Link
🔨 Latest commit	0906651
🔍 Latest deploy log	https://app.netlify.com/sites/hypershift-docs/deploys/663b4ebae5d0680008d69889
😎 Deploy Preview	https://deploy-preview-3992--hypershift-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[stevekuznetsov]

/lgtm
/retest

[Tal-or]

I added the permissions to the control plane operator but the error persist:

    hypershift_framework.go:395: ReconciliationSucceeded, Reason: ReconciliationError, Message: failed to reconcile control plane operator: failed to reconcile controlplane operator role: roles.rbac.authorization.k8s.io "control-plane-operator" is forbidden: user "system:serviceaccount:hypershift:operator" (groups=["system:serviceaccounts" "system:serviceaccounts:hypershift" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
        {APIGroups:[""], Resources:["configmaps/finalizers"], Verbs:["*"]}

[Tal-or]

I added the permissions to the control plane operator but the error persist:

    hypershift_framework.go:395: ReconciliationSucceeded, Reason: ReconciliationError, Message: failed to reconcile control plane operator: failed to reconcile controlplane operator role: roles.rbac.authorization.k8s.io "control-plane-operator" is forbidden: user "system:serviceaccount:hypershift:operator" (groups=["system:serviceaccounts" "system:serviceaccounts:hypershift" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
        {APIGroups:[""], Resources:["configmaps/finalizers"], Verbs:["*"]}

@sjenning Could you please have take a look? it seems like the hypershift operator needs some additional permissions as well but I couldn't find the relevant files

[Tal-or]

/retest

[Tal-or]

/retest

[stevekuznetsov]

/lgtm
/retest

[Tal-or]

/retest

[Tal-or]

The failure doesn't seems related to this PR and also reproduced on other PRs here

error: timed out waiting for the condition on hostedclusters/400b93ce3e99541261a6-mgmt
{"component":"entrypoint","error":"wrapped process failed: exit status 1","file":"sigs.k8s.io/prow/pkg/entrypoint/run.go:84","func":"sigs.k8s.io/prow/pkg/entrypoint.Options.internalRun","level":"error","msg":"Error executing test process","severity":"error","time":"2024-05-15T08:15:19Z"}
error: failed to execute wrapped command: exit status 1
---
Link to step on registry info site: https://steps.ci.openshift.org/reference/create-management-cluster
Link to job on registry info site: https://steps.ci.openshift.org/job?org=openshift&repo=hypershift&branch=main&test=e2e-azure, "e2e-azure" post steps failed: "e2e-azure" pod "e2e-azure-destroy-management-cluster" failed: could not watch pod: the pod ci-op-k9wjbwri/e2e-azure-destroy-management-cluster failed after 40m11s (failed containers: test): ContainerFailed one or more containers exited
Container test exited with code 1, reason Error
---
enshift/hypershift/cmd/cluster/core.waitForRestOfFinalizers
	/hypershift/cmd/cluster/core/destroy.go:198
github.com/openshift/hypershift/cmd/cluster/core.DestroyCluster
	/hypershift/cmd/cluster/core/destroy.go:119
github.com/openshift/hypershift/cmd/cluster/azure.DestroyCluster
	/hypershift/cmd/cluster/azure/destroy.go:71
github.com/openshift/hypershift/cmd/cluster/azure.NewDestroyCommand.func1
	/hypershift/cmd/cluster/azure/destroy.go:41
github.com/spf13/cobra.(*Command).execute
	/hypershift/vendor/github.com/spf13/cobra/command.go:920
github.com/spf13/cobra.(*Command).ExecuteC
	/hypershift/vendor/github.com/spf13/cobra/command.go:1044
github.com/spf13/cobra.(*Command).Execute
	/hypershift/vendor/github.com/spf13/cobra/command.go:968
github.com/spf13/cobra.(*Command).ExecuteContext
	/hypershift/vendor/github.com/spf13/cobra/command.go:961
main.main
	/hypershift/main.go:70

[sjenning]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sjenning, Tal-or

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sjenning]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@Tal-or: This pull request references CNF-12792 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.16.0" version, but no target version was set.

In response to this:

What this PR does / why we need it:
NTO is watching for the ConfigMap that encpasulets the PerformanceProfile and creates different components based on the given profile.

We should block the PerformanceProfile deletion as long as the dependent components exist.

For that NTO needs access the finalizers of the ConfigMap.

We should also update the control plane operator since
it's its responsibility to update NTO's role.

Which issue(s) this PR fixes
Fixes # CNF-11559

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD a492a9a and 2 for PR HEAD 4f17a8d in total

[Tal-or]

/retest-required

[Tal-or]

/jira refresh

[openshift-ci-robot]

@Tal-or: This pull request references CNF-12792 which is a valid jira issue.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[Tal-or]

/retest-required

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 630c4d8 and 1 for PR HEAD 4f17a8d in total

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD c698d1d and 0 for PR HEAD 4f17a8d in total

[openshift-ci-robot]

/hold

Revision 4f17a8d was retested 3 times: holding

[Tal-or]

/retest-required

[Tal-or]

/retest-required

[Tal-or]

/test e2e-kubevirt-aws-ovn

[Tal-or]

/test e2e-kubevirt-aws-ovn

[Tal-or]

/retest

[openshift-ci]

@Tal-or: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-azure	4f17a8d	link	false	/test e2e-azure

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[Tal-or]

/hold cancel