ROX-27758: Allow ACS team read secured cluster namespace secrets

[kurlov]

What type of PR is this?

feature

What this PR does / why we need it?

Which Jira/Github issue(s) this PR fixes?

ACS team has ACS Central connected to the ACSCS clusters and has secured cluster configured under rhacs-secured-cluster namespace. ACS team owns Central of this Secured Cluster instance. The secured cluster requires to fetch secrets to debug or test specific features

Fixes ROX-27758

Special notes for your reviewer:

Pre-checks (if applicable):

• [ ] Tested latest changes against a cluster

• [ ] Included documentation changes with PR

• [ ] If this is a new object that is not intended for the FedRAMP environment (if unsure, please reach out to team FedRAMP), please exclude it with:

  matchExpressions:
  - key: api.openshift.com/fedramp
    operator: NotIn
    values: ["true"]
  

[openshift-ci-robot]

@kurlov: This pull request references ROX-27758 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.19.0" version, but no target version was set.

In response to this:

What type of PR is this?

feature

What this PR does / why we need it?

Which Jira/Github issue(s) this PR fixes?

ACS team has ACS Central connected to the ACSCS clusters and has secured cluster configured under rhacs-secured-cluster namespace. ACS team owns this Central and sometimes it requires to fetch secrets to debug or test specific feature on this Central

Fixes ROX-27758

Special notes for your reviewer:

Pre-checks (if applicable):

• [ ] Tested latest changes against a cluster

• [ ] Included documentation changes with PR

• [ ] If this is a new object that is not intended for the FedRAMP environment (if unsure, please reach out to team FedRAMP), please exclude it with:

  matchExpressions:
  - key: api.openshift.com/fedramp
    operator: NotIn
    values: ["true"]
  

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci[bot]]

@kurlov: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@kurlov: This pull request references ROX-27758 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.19.0" version, but no target version was set.

In response to this:

What type of PR is this?

feature

What this PR does / why we need it?

Which Jira/Github issue(s) this PR fixes?

ACS team has ACS Central connected to the ACSCS clusters and has secured cluster configured under rhacs-secured-cluster namespace. ACS team owns Central of this Secured Cluster instance. The secured cluster requires to fetch secrets to debug or test specific features

Fixes ROX-27758

Special notes for your reviewer:

Pre-checks (if applicable):

• [ ] Tested latest changes against a cluster

• [ ] Included documentation changes with PR

• [ ] If this is a new object that is not intended for the FedRAMP environment (if unsure, please reach out to team FedRAMP), please exclude it with:

  matchExpressions:
  - key: api.openshift.com/fedramp
    operator: NotIn
    values: ["true"]
  

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[T0MASD]

/lgtm this does not expose customer secrets, rather internal instances aka dogfood instances of ACS centrals

[openshift-ci[bot]]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: kurlov, T0MASD Once this PR has been reviewed and has the lgtm label, please assign bng0y, jharrington22 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS
• docs/backplane/OWNERS

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

[cblecker]

/hold

[T0MASD]

@cblecker the jira ROX-2775 was updated with the scope and impact of the permission

[kurlov]

See ticket comments for details