resources/deployment.yaml - needs rbac update for 1.18 kubernetes

[fred-vogt]

k8s 1.18 has added a signerName field which requires additional permissions for signers:approve:

• https://kubernetes.io/docs/setup/release/notes/#kube-apiserver
  • https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/

Manifest:

• https://github.com/proofpoint/kapprover/blob/master/resources/deployment.yaml

Logs:

level=error ... user not permitted to approve requests with signerName "kubernetes.io/legacy-unknown"

For "legacy" requestors not setting the field such as proofpoint/certificate-init-container

- apiGroups: ["certificates.k8s.io"]
  resources: [signers]
  resourceNames: ["kubernetes.io/legacy-unknown"]
  verbs: [approve]

[fred-vogt]

The killer combo for custom API server *admission webhooks would be:

• proofpoint/certificate-init-container - webhook pod, creating a CSR for a service
• proofpoint/kapprover approve the CSR for the webhook's svc

kubernetes.io/legacy-unknown seems to be the default value for CSR created without setting the signerName.

Example rbac updates from other projects with approvers:

• Fix Istiod CSR on Kubernetes 1.18 istio/istio#22084