Merge branch 'kubernetes_cluster_namespace_role_admin' into 'master'

Switch to using admin for project rolebindings

See merge request gitlab-org/gitlab!45479

app/services/clusters/kubernetes/create_or_update_service_account_service.rb

@@ -117,9 +117,11 @@ module Clusters
       end
 
       def role_binding_resource
+        role_name = Feature.enabled?(:kubernetes_cluster_namespace_role_admin) ? 'admin' : Clusters::Kubernetes::PROJECT_CLUSTER_ROLE_NAME
+
         Gitlab::Kubernetes::RoleBinding.new(
           name: role_binding_name,
-          role_name: Clusters::Kubernetes::PROJECT_CLUSTER_ROLE_NAME,
+          role_name: role_name,
           role_kind: :ClusterRole,
           namespace: service_account_namespace,
           service_account_name: service_account_name

config/feature_flags/development/kubernetes_cluster_namespace_role_admin.yml

+---
+name: kubernetes_cluster_namespace_role_admin
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45479
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/270030
+type: development
+group: group::configure
+default_enabled: false

spec/services/clusters/kubernetes/create_or_update_service_account_service_spec.rb

@@ -160,26 +160,60 @@ RSpec.describe Clusters::Kubernetes::CreateOrUpdateServiceAccountService do
 
       it_behaves_like 'creates service account and token'
 
-      it 'creates a namespaced role binding with edit access' do
-        subject
+      context 'kubernetes_cluster_namespace_role_admin FF is enabled' do
+        before do
+          stub_feature_flags(kubernetes_cluster_namespace_role_admin: true)
+        end
+
+        it 'creates a namespaced role binding with admin access' do
+          subject
+
+          expect(WebMock).to have_requested(:put, api_url + "/apis/rbac.authorization.k8s.io/v1/namespaces/#{namespace}/rolebindings/#{role_binding_name}").with(
+            body: hash_including(
+              metadata: { name: "gitlab-#{namespace}", namespace: "#{namespace}" },
+              roleRef: {
+                apiGroup: 'rbac.authorization.k8s.io',
+                kind: 'ClusterRole',
+                name: 'admin'
+              },
+              subjects: [
+                {
+                  kind: 'ServiceAccount',
+                  name: service_account_name,
+                  namespace: namespace
+                }
+              ]
+            )
+          )
+        end
+      end
 
-        expect(WebMock).to have_requested(:put, api_url + "/apis/rbac.authorization.k8s.io/v1/namespaces/#{namespace}/rolebindings/#{role_binding_name}").with(
-          body: hash_including(
-            metadata: { name: "gitlab-#{namespace}", namespace: "#{namespace}" },
-            roleRef: {
-              apiGroup: 'rbac.authorization.k8s.io',
-              kind: 'ClusterRole',
-              name: 'edit'
-            },
-            subjects: [
-              {
-                kind: 'ServiceAccount',
-                name: service_account_name,
-                namespace: namespace
-              }
-            ]
+      context 'kubernetes_cluster_namespace_role_admin FF is disabled' do
+        before do
+          stub_feature_flags(kubernetes_cluster_namespace_role_admin: false)
+        end
+
+        it 'creates a namespaced role binding with edit access' do
+          subject
+
+          expect(WebMock).to have_requested(:put, api_url + "/apis/rbac.authorization.k8s.io/v1/namespaces/#{namespace}/rolebindings/#{role_binding_name}").with(
+            body: hash_including(
+              metadata: { name: "gitlab-#{namespace}", namespace: "#{namespace}" },
+              roleRef: {
+                apiGroup: 'rbac.authorization.k8s.io',
+                kind: 'ClusterRole',
+                name: 'edit'
+              },
+              subjects: [
+                {
+                  kind: 'ServiceAccount',
+                  name: service_account_name,
+                  namespace: namespace
+                }
+              ]
+            )
           )
-        )
+        end
       end
 
       it 'creates a role binding granting crossplane database permissions to the service account' do