🐛 fix rbac aggregation manager role

[seanschneeweiss]

What this PR does / why we need it:
The manager aggregation patch for kustomization does not match the correct ClusterRole. This fix ensures to use the correct ClusterRole definition, instead of overwriting it with the broken patch.

We've seen the following errors:

[manager] E0211 09:08:55.893564       8 reflector.go:153] pkg/mod/k8s.io/client-go@v0.17.9/tools/cache/reflector.go:105: Failed to list *v1alpha3.OpenStackCluster: openstackclusters.infrastructure.cluster.x-k8s.io is forbidden: User "system:serviceaccount:capo-system:default" cannot list resource "openstackclusters" in API group "infrastructure.cluster.x-k8s.io" at the cluster scope: RBAC: clusterrole.rbac.authorization.k8s.io "capi-system-capi-aggregated-manager-role" not found
[manager] E0211 09:08:55.893677       8 reflector.go:153] pkg/mod/k8s.io/client-go@v0.17.9/tools/cache/reflector.go:105: Failed to list *v1alpha3.OpenStackMachine: openstackmachines.infrastructure.cluster.x-k8s.io is forbidden: User "system:serviceaccount:capo-system:default" cannot list resource "openstackmachines" in API group "infrastructure.cluster.x-k8s.io" at the cluster scope: RBAC: clusterrole.rbac.authorization.k8s.io "capi-system-capi-aggregated-manager-role" not found

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:
Removing the config/default/manager_role_aggregation_patch.yaml patch should fix this problem.

Release note:

NONE

_{Sean Schneeweiss sean.schneeweiss@daimler.com, Daimler TSS GmbH, legal info/Impressum}

[k8s-ci-robot]

Hi @seanschneeweiss. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[fejta-bot]

Unknown CLA label state. Rechecking for CLA labels.

Send feedback to sig-contributor-experience at kubernetes/community.
/check-cla

[theopenlab-ci]

Build failed.

• cluster-api-provider-openstack-current-acceptance-test-v1.18 : FAILURE in 55m 34s

[sbueringer]

recheck

[sbueringer]

/ok-to-test

[sbueringer]

@hidekazuna @jichenjc
Some additional info:

• we compared the CAPO implementation with the one in CAPA:
  • the general pattern seems to be to just define and use the ClusterRole (and ClusterRoleBinding) inside of CAPA/CAPO
  • our current master implementation has a ClusterRolebinding which depends on a ClusterRole of the ClusterAPI main deployment, which in turn refers back to ours
  • but because this ClusterRoleBinding has the same name as our own it is usually overwritten.
  • Afaik this somehow still works when using clusterctl but not when deploying the regular YAML files
  • CAPA still has the kustomize patch file we're deleting here, but they are not using it (and thus it's not contained in the release yamls)

Slightly off-topic:

• we're slowly starting to use CAPO in production right now, so just fyi, there will be a lot more PRs and contributions from my team in the coming weeks/ months :)

[sbueringer]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sbueringer, seanschneeweiss

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sbueringer]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[theopenlab-ci]

Build failed.

• cluster-api-provider-openstack-current-acceptance-test-v1.18 : FAILURE in 55m 00s

[hidekazuna]

/lgtm