RBAC Role rules for namespaces outside of the app itself

[maelvls]

Hi,

I am maintaining https://github.com/jetstack/jetstack-secure-gcm and am currently hitting an issue with the rulesType: CUSTOM block.

I want to create a Role for the namespace kube-system so that cert-manager can deal with leader election. The problem is that I can only create a Role for the app's namespace. For example, with:

x-google-marketplace:
  schemaVersion: v2
properties:
  cert-manager.serviceAccount.name:
    type: string
    title: Name of the Kubernetes service account for the cert-manager controller
    x-google-marketplace:
      type: SERVICE_ACCOUNT
      serviceAccount:
        description: Service account used by cert-manager Controller Deployment
        roles:
          - type: Role
            rulesType: CUSTOM
            rules:
              # Leader election roles.
              - apiGroups: [""]
                resources: [configmaps]
                verbs: [get, list, watch, create, update, patch, delete]
              - apiGroups: [""]
                resources: [configmaps/status]
                verbs: [get, update, patch]
              - apiGroups: [coordination.k8s.io]
                resources: [leases]
                verbs: [create, get, update, patch]

then cert-manager won't be able to start since it only can read/write the ConfigMaps on its own namespace, and not on kube-system which is the default namespace for leader election.

I noticed in the click-to-deploy cert-manager 0.13 schema.yaml that the workaround used is to just use a ClusterRole instead of a more restrictive Role:

x-google-marketplace:
  schemaVersion: v2
properties:
  controller.serviceAccountName:
    type: string
    title: Controller Service Account
    x-google-marketplace:
      type: SERVICE_ACCOUNT
      serviceAccount:
        description: Service account used by cert-manager Controller Deployment
        roles:
        - type: ClusterRole
          rulesType: CUSTOM
          rules:
            - apiGroups: [""]
              resources: ["configmaps"]
              verbs: ["get", "create", "update", "patch"]

Should I use a ClusterRole instead, like with click-to-deploy?

Another question would be: is it possible to set variables to configure the Roles themselves? For example:

x-google-marketplace:
  schemaVersion: v2
properties:
  cert-manager.serviceAccount.name:
    type: string
    title: Name of the Kubernetes service account for the cert-manager controller
    x-google-marketplace:
      type: SERVICE_ACCOUNT
      serviceAccount:
        description: Service account used by cert-manager Controller Deployment
        roles:
          - type: ClusterRole
            rulesType: CUSTOM
            rules:
              - apiGroups: ["coordination.k8s.io"]
                resources: ["leases"]
                resourceNames: ["${APP_NAME}-leader-election"]  # 🔰 Uses the $APP_NAME var
                verbs: ["get", "update", "patch"]

where APP_NAME is interpolated to the name of the application deployed on the Marketplace.

Thank you.