Changes

UPSTREAM: 48480: Ensure namespace exists as part of RBAC reconciliation
 (commit: 70ec58f)

Cleanup: Check for error conditions in aggregator
Signed-off-by: Monis Khan <mkhan@redhat.com>
 (commit: e668952)

Cleanup: Remove custom code and use available utility code
 (commit: f5388b3)

Cleanup: Move conversion function
Put it into a utility package for reusability, we'll need it in other
places in the next few commits
Signed-off-by: Simo Sorce <simo@redhat.com>
 (commit: 9811649)

UPSTREAM: 50639:  Extend SetHeader Requests method ito accept multiple
values
This allows to set headers that are multivalued directly. The headers
variable is not directly accessible and currently SetHeaders allows to
set only one value.
Signed-off-by: Simo Sorce <simo@redhat.com>
 (commit: 230db26)

Proxy {Cluster}Role{Binding}s to Native Kube RBAC
Store them as native RBAC Objects via Kubernetes. Also:
- Provides backwards compatible Openshift API.
- Kills Policy Sync Controller
- Removes init of PolicyRegistry
- Move helpers closer to their users
- Remove TestRBACController
- Remove tests that check only PolicyBindings related stuff
- hack around TestAuthorizationResolution
Signed-off-by: Simo Sorce <simo@redhat.com> Signed-off-by: Monis Khan
<mkhan@redhat.com>
 (commit: c96408a)

Use dynamic error wrapper on proxied endpoints
Signed-off-by: Monis Khan <mkhan@redhat.com>
 (commit: f080a1b)

UPSTREAM: 50702: Allow injection of policy in RBAC post start hook
This change allows the RBAC PostStartHook logic to be reused with 
different policy data when bootstrapping the cluster.  Thus any changes
to the bootstrap logic are separated from the policy data.
Signed-off-by: Monis Khan <mkhan@redhat.com>
 (commit: 1bb9a94)

Bootstrap Origin policies in post start hook
As we now use K8s' Rbac we need to bootstrap Origin's own additional
policies into kube's rbac objects. Also:
- Push conversions one step toward the edges
- Fix conversion and dont make policy.json
- delete TestBootstrapPolicyOverwritePolicyCommand for now
Signed-off-by: Monis Khan <mkhan@redhat.com> Signed-off-by: Simo Sorce
<simo@redhat.com>
 (commit: d278ea6)

Version gate legacy oc commands to < 3.7
The following commands were version gated:
- oc create policybinding
- oc adm overwrite-policy
- oc adm migrate authorization
This is because in 3.7 we will store only k8s.io RBAC objects and not
the Origin Policy Objects.  All of the gated commands assume the 
presence of policy objects, and thus it does not make sense to let users
run these against newer clusters.
Signed-off-by: Simo Sorce <simo@redhat.com> Signed-off-by: Monis Khan
<mkhan@redhat.com>
 (commit: acd6597)

UPSTREAM: 50710: Refactor RBAC authorizer entry points
This change refactors various RBAC authorizer functions to be more 
flexible in their inputs.  This makes it easier to reuse the various 
components that make up the authorizer.
Signed-off-by: Monis Khan <mkhan@redhat.com>
 (commit: c7d2994)

Change authorizer to use Kubernetes facilities
- Origin Authorizer now a thin wrapper around k8s Rbac Authorizer
- Remove redundant authorizer tests
 Now that we delegate nearly 100% of the authorizer work to the
 upstream Rbac authorizer these tests are basically redundant,
 as upstream already has its battery of tests.
Signed-off-by: Simo Sorce <simo@redhat.com> Signed-off-by: Monis Khan
<mkhan@redhat.com>
 (commit: a94e0db)

UPSTREAM: 49902: Allow update to GC fields for RBAC resources
This change makes it so that no escalation check is performed when 
updating only the garbage collector fields (owner references and 
finalizers) of RBAC resources.  This allows the garbage collector to
delete roles that grant permissions such as "create", which it will
never have.
Signed-off-by: Monis Khan <mkhan@redhat.com>
 (commit: f0704fd)

Update admission to use moved GC helper
Signed-off-by: Monis Khan <mkhan@redhat.com>
 (commit: 8cf692d)

flakes fixes
- Increase timeout to avoid TestGCDefault flaking
 Locally raising timeout from 1 to 2 seconds made the test always
 pass, as opposed to always fail.
- Make TestOadmPodNetwork less flakey
Signed-off-by: Simo Sorce <simo@redhat.com> Signed-off-by: Monis Khan
<mkhan@redhat.com>
 (commit: c51da07)

test/cmd fixes
- Fix test/cmd/admin.sh
- Fix images-old-policy
- Fix test/cmd/policy.sh
- Temp fix for test/cmd/router.sh
Signed-off-by: Monis Khan <mkhan@redhat.com>
 (commit: 806d7be)

(re)generated stuff
 (commit: be05ce5)

Handle reconciliation annotation during conversion
Signed-off-by: Simo Sorce <simo@redhat.com>
 (commit: 33c4fc3)