Change multi-tenancy allowed namespaces to be more restrictive

[nader-ziada]

/kind feature

Describe the solution you'd like
[A clear and concise description of what you want to happen.]

• Currently in the multi-tenancy implemenations, allowed namespaces is by default open to any namespaces
• Other CAP* provider have a little bit more restrictive approach like the following:

empty allowedNamespaces --> allows all namespaces
nil allowedNamespaces --> blocks all namespaces

nil NamespaceList --> blocks all
nil Selector --> blocks all

• Consistency between providers is highly desirable, so the request here is to make capz consistent with other providers by adding LabelSelector and following the behaviour mentioned above

Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]
discussion here: kubernetes-sigs/cluster-api-provider-vsphere#1149 (comment)

Environment:

• cluster-api-provider-azure version:
• Kubernetes version: (use kubectl version):
• OS (e.g. from /etc/os-release):

[nader-ziada]

/milestone v0.5.0

[nader-ziada]

/assign

[nader-ziada]

I've looked at examples in kubernetes itself and think was wondering if we just should use the labelSelector and not have the []string . We originally added the []string because we had some implementations issues with the label

@gab-satchi @sedefsavas what do you think? why would we need both?

[gab-satchi]

Having a labelSelector adds flexibility where namespaces can be added/removed without modifying the Identity. I can't think of any advantages the []string brings

[sedefsavas]

I think one benefit is in terms of security, []string gives us a way to limit the usage of an identity more explicitly and less prone to mistakes like adding matching labels to a namespace that should not have access to an identity. Access control is being more on the identity object side when we define allowedNamespaces as a list.

[devigned]

Say I'm Alex and I want to gain access to your identity. I have access to create a namespace. I create a namespace and label it with something I know your identity will select. Boom, I am now using your identity.

^ I'm really concerned about label selectors with this scenario.