Give RBAC permission to read listeners

[nightkr]

Description

This is required for listener volume scopes that use manually created listeners

Definition of Done Checklist

• Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
• Please make sure all these things are done and tick the boxes

Author

Preview Give feedback

1. Changes are OpenShift compatible
2. CRD changes approved
3. CRD documentation for all fields, following the style guide.
4. Helm chart can be installed and deployed operator works
5. Integration tests passed (for non trivial changes)
6. Changes need to be "offline" compatible

Reviewer

Preview Give feedback

1. Code contains useful comments
2. Code contains useful logging statements
3. (Integration-)Test cases added
4. Documentation added or updated. Follows the style guide.
5. Changelog updated
6. Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

Preview Give feedback

1. Feature Tracker has been updated
2. Proper release label has been added
3. Roadmap has been updated

[lfrancke]

Should this be mentioned in the release notes? If so: Could you add asnippet?

[nightkr]

I'd say no, unless you want to list every bugfix (and at that point, what's the difference vs the changelog again?).

[lfrancke]

It's a subjective thing. I thought this might warrant an entry because it's security relevant and should someone not use our Helm charts for some reason, they'd need to take action.

Also....do we need to do anything for OpenShift here @razvan @adwk67?

[razvan]

Yes, we need to to check for this when updating OLM

[lfrancke]

Do we have an issue or anything else to track this so we don't forget? If not: Do we need it?

[razvan]

I'd say we don't need an issue for it. Diffing cluster roles between Helm and OLM is part of the process. Also the OpenShift tests will hopefully catch any inconsistencies.

[nightkr]

Well if you want to add a release note for it, something like:

The Stackable Secret Operator now requests permission to read Listeners, which is required to provision secrets for listener volumes with listeners.stackable.tech/listener-name.