conjur-authenticator rolebinding requires elevated privileges to create

[jodyhuntatx]

$ oc whoami
developer

$ oc get clusterrolebindings
Error from server (Forbidden): clusterrolebindings.authorization.openshift.io is forbidden: User "developer" cannot list clusterrolebindings.authorization.openshift.io at the cluster scope: User "developer" cannot list all clusterrolebindings.authorization.openshift.io in the cluster

$ ./3_create_test_app_namespace.sh

• set -euo pipefail

• . utils.sh
  ++ PLATFORM=openshift
  ++ '[' openshift = kubernetes ']'
  ++ '[' openshift = openshift ']'
  ++ cli=oc

• announce 'Creating Test App namespace.'

• echo ++++++++++++++++++++++++++++++++++++++
  ++++++++++++++++++++++++++++++++++++++

• echo ''

• echo 'Creating Test App namespace.'
  Creating Test App namespace.

• echo ''

• echo ++++++++++++++++++++++++++++++++++++++
  ++++++++++++++++++++++++++++++++++++++

• set_namespace default

• [[ 1 != 1 ]]
  ++ oc config current-context

• oc config set-context jodyapp/192-168-99-100:8443/developer --namespace=default

• has_namespace jodyapp

• oc get namespace jodyapp

• true

• echo 'Namespace '''jodyapp''' exists, not going to create it.'
  Namespace 'jodyapp' exists, not going to create it.

• set_namespace jodyapp

• [[ 1 != 1 ]]
  ++ oc config current-context

• oc config set-context jodyapp/192-168-99-100:8443/developer --namespace=jodyapp

• oc delete --ignore-not-found rolebinding test-app-conjur-authenticator-role-binding

• sed -e 's#{{ TEST_APP_NAMESPACE_NAME }}#jodyapp#g' ./openshift/test-app-conjur-authenticator-role-binding.yml

• sed -e 's#{{ CONJUR_NAMESPACE_NAME }}#conjur#g'

• oc create -f -
  Error from server (NotFound): error when creating "STDIN": rolebindings "conjur-authenticator" not found

[jodyhuntatx]

"developer" is same user that deployed the Conjur cluster, but needs some extra privilege to create the role binding in the application name space. Logging in as system:admin allows creation of the role binding without error.

[jodyhuntatx]

$ oc adm policy add-role-to-user cluster-admin $USER -n $TEST_APP_NAMESPACE_NAME

The above grants a user sufficient privilege to create the cluster rolebinding w/o using system:admin. However this will no doubt raise some concerns for general deployment.

We really need to prescribe the roles and workflow needed to:
a) deploy/manage the Conjur cluster
b) setup application deployments
c) deploy applications .