feat(deployment): multi-user mode manifests for subject access review…

… integration. Fixes #3513 (#5314)

manifests/kustomize/base/installs/multi-user/api-service/cluster-role.yaml

@@ -3,6 +3,15 @@ kind: ClusterRole
 metadata:
   name: ml-pipeline
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
+  - delete
 - apiGroups:
   - argoproj.io
   resources:
@@ -27,8 +36,8 @@ rules:
   - patch
   - delete
 - apiGroups:
-  - ""
+  - authorization.k8s.io
   resources:
-  - pods
+  - subjectaccessreviews
   verbs:
-  - delete
+  - create

manifests/kustomize/base/installs/multi-user/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
 - ../../pipeline/cluster-scoped
 - ../../cache-deployer/cluster-scoped
 - ../generic
+- view-edit-cluster-roles.yaml
 - api-service
 - pipelines-ui
 - pipelines-profile-controller

manifests/kustomize/base/pipeline/multi-user/view-edit-roles.yaml → manifests/kustomize/base/installs/multi-user/view-edit-cluster-roles.yaml

@@ -9,11 +9,11 @@ kind: ClusterRole
 metadata:
   labels:
     rbac.authorization.kubeflow.org/aggregate-to-kubeflow-edit: "true"
-  name: kubeflow-pipeline-edit
+  name: kubeflow-pipelines-edit
 aggregationRule:
   clusterRoleSelectors:
   - matchLabels:
-      rbac.authorization.kubeflow.org/aggregate-to-kubeflow-pipeline-edit: "true"
+      rbac.authorization.kubeflow.org/aggregate-to-kubeflow-pipelines-edit: "true"
 rules: []
 
 ---
@@ -22,13 +22,13 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    rbac.authorization.kubeflow.org/aggregate-to-kubeflow-pipeline-edit: "true"
+    rbac.authorization.kubeflow.org/aggregate-to-kubeflow-pipelines-edit: "true"
     rbac.authorization.kubeflow.org/aggregate-to-kubeflow-view: "true"
-  name: kubeflow-pipeline-view
+  name: kubeflow-pipelines-view
 aggregationRule:
   clusterRoleSelectors:
   - matchLabels:
-      rbac.authorization.kubeflow.org/aggregate-to-kubeflow-pipeline-view: "true"
+      rbac.authorization.kubeflow.org/aggregate-to-kubeflow-pipelines-view: "true"
 rules: []
 
 ---
@@ -37,8 +37,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    rbac.authorization.kubeflow.org/aggregate-to-kubeflow-pipeline-edit: "true"
-  name: aggregate-to-pipeline-edit
+    rbac.authorization.kubeflow.org/aggregate-to-kubeflow-pipelines-edit: "true"
+  name: aggregate-to-kubeflow-pipelines-edit
 rules:
 - apiGroups:
   - pipelines.kubeflow.org
@@ -85,8 +85,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    rbac.authorization.kubeflow.org/aggregate-to-kubeflow-pipeline-view: "true"
-  name: aggregate-to-pipeline-view
+    rbac.authorization.kubeflow.org/aggregate-to-kubeflow-pipelines-view: "true"
+  name: aggregate-to-kubeflow-pipelines-view
 rules:
 - apiGroups:
   - pipelines.kubeflow.org