chore(KFLUXSPRT-3001): konflux-support read access in all namespaces

[Omeramsc]

introduces a ClusterPolicy to automatically generate the konflux-read-only-binding RoleBinding in all application namespaces, granting konflux-sre and ai-konflux-user-support view access via the konflux-viewer-user-actions ClusterRole.

• The policy explicitly uses synchronize: true and background: true, overriding general Kyverno performance best practices. This is intentional to ensure non-negotiable support access:

• background: true: Required for immediate retroactive application to all existing Konflux tenant namespaces.

• synchronize: true: Required to make the RoleBinding self-healing. If an application user or process deletes the binding, Kyverno automatically reinstates it, guaranteeing persistent visibility for SRE/Support teams.

Assisted-by: Cursor

[github-actions]

🤖 Gemini AI Assistant Available

Hi @Omeramsc! I'm here to help with your pull request. You can interact with me using the following commands:

Available Commands

• @gemini-cli /review - Request a comprehensive code review

  • Example: @gemini-cli /review Please focus on security and performance

• @gemini-cli <your question> - Ask me anything about the codebase

  • Example: @gemini-cli How can I improve this function?
  • Example: @gemini-cli What are the best practices for error handling here?

How to Use

1. Simply type one of the commands above in a comment on this PR
2. I'll analyze your code and provide detailed feedback
3. You can track my progress in the workflow logs

Permissions

Only OWNER, MEMBER, or COLLABORATOR users can trigger my responses. This ensures secure and appropriate usage.

---

This message was automatically added to help you get started with the Gemini AI assistant. Feel free to delete this comment if you don't need assistance.

[github-actions]

🤖 Hi @Omeramsc, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

[sadlerap]

As a heads up, looks like yamllint throws a few warnings from your changes.

[filariow]

great work! 👍🏾

This PR is updating dev/staging/production at the same time. We should target dev/stage first, then production. Can you split them?

These kind of policies (synchronize, generateExisting) can put a lot of pressure on kyverno and on the cluster, we should check kyverno performance and -in case- increase resource requests/limits.

[Omeramsc]

added #8841 with changes to production

[gbenhaim]

we already have [1] https://github.com/redhat-appstudio/infra-deployments/blob/main/components/authentication/base/everyone-can-view.yaml why do we need to use a policy for generating the role bindings? is it going to replace [1]?

[filariow]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: filariow, Omeramsc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• components/policies/OWNERS [filariow]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[filariow]

/test appstudio-upgrade-tests

/hold
to allow you to reply to @gbenhaim's comment

[Omeramsc]

@gbenhaim I wasn't aware of that policy, but it seems like the two serve similar, but different purposes.
the new policy is not static, but is using self-healing via Kyverno to recreate it if deleted by a tenant. it also automatically applies to new tenant namespaces. is that available with everyone-can-view?

the new policy also is specific to the two groups, konflux-sre and ai-konflux-user-support. although as mention before we may make it even more, user-specific, to have access via the UI as well.

[gbenhaim]

everyone-can-view is applied to all namespaces. The benefit of using the policy is that than permissions would be given only in tenant namespaces. I support this change since its more secure, but I think it should replace everyone-can-view.
@hugares @filariow thoughs?

[hugares]

everyone-can-view is applied to all namespaces. The benefit of using the policy is that than permissions would be given only in tenant namespaces. I support this change since its more secure, but I think it should replace everyone-can-view. @hugares @filariow thoughs?

Everyone-can-view clusterrole that we grant to all Konflux dev is different that this policy. everyone-can-view basically grant view access to a lot of resources in the OCP cluster and having access to those can help troubleshooting things but it does not grant access to the tenants NS from Konflux UI, which this PR is addressing.

everyone-can view cover the use case of Konflux dev accessing tenants ns using back door but also when they need to access Konflux control plane resources, pods, logs,... of the Konflux services. We can always get rid of it but we will need to beef up the permissions granted for each konflux components before removing it otherwise we cannot troubleshoot Konflux issues

[gbenhaim]

| but it does not grant access to the tenants NS from Konflux UI, which this PR is addressing.

This pr is one step in this way, but not a full implementation since it gives the permissions to groups which the ui currently not support.

[gbenhaim]

/lgtm
@filariow feel free to merge it.

[Omeramsc]

@gbenhaim I think we should start with this approach, once this is merged I'll see how can we set all the required user, and then proceed with the same approach on prod.
my team's ETA for this feature is Nov 20th, and hopefully way before, so we are planning on getting it done soon.

[openshift-ci]

New changes are detected. LGTM label has been removed.

[Omeramsc]

@filariow @hugares can this be merged?

[openshift-ci]

@Omeramsc: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/appstudio-e2e-tests	8f05ec2	link	true	/test appstudio-e2e-tests

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.