Update SCC and RBAC handling for DevWorkspaces

pkg/common/naming.go

@@ -146,10 +146,18 @@ func WorkspaceSCCRolebindingName(sccName string) string {
 	return fmt.Sprintf("devworkspace-use-%s", sccName)
 }
 
+// OldWorkspaceRoleName returns the name used for the workspace serviceaccount role
+//
+// Deprecated: use WorkspaceRoleName() instead.
+// TODO: remove for DevWorkspace Operator v0.19
 func OldWorkspaceRoleName() string {
 	return "workspace"
 }
 
+// OldWorkspaceRolebindingName returns the name used for the workspace serviceaccount rolebinding
+//
+// Deprecated: use WorkspaceRoleBindingName() instead.
+// TODO: remove for DevWorkspace Operator v0.19
 func OldWorkspaceRolebindingName() string {
 	return constants.ServiceAccount + "dw"
 }

pkg/provision/workspace/rbac/common.go

@@ -46,6 +46,9 @@ func wrapSyncError(err error) error {
 }
 
 func SyncRBAC(workspace *common.DevWorkspaceWithConfig, api sync.ClusterAPI) error {
+	if err := cleanupDeprecatedRBAC(workspace.Namespace, api); err != nil {
+		return err
+	}
 	if err := syncRoles(workspace, api); err != nil {
 		return err
 	}

pkg/provision/workspace/rbac/migrate.go

@@ -0,0 +1,66 @@
+// Copyright (c) 2019-2022 Red Hat, Inc.
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rbac
+
+import (
+	"fmt"
+
+	"github.com/devfile/devworkspace-operator/pkg/common"
+	"github.com/devfile/devworkspace-operator/pkg/provision/sync"
+	rbacv1 "k8s.io/api/rbac/v1"
+	k8sErrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// cleanupDeprecatedRBAC removes old Roles and RoleBindings created by an earlier version
+// of the DevWorkspace Operator. These earlier roles and rolebindings are no longer used
+// and need to be removed directly as there is no usual mechanism for their removal.
+// TODO: Remove this functionality for DevWorkspace Operator v0.19
+func cleanupDeprecatedRBAC(namespace string, api sync.ClusterAPI) error {
+	role := &rbacv1.Role{}
+	roleNN := types.NamespacedName{
+		Name:      common.OldWorkspaceRoleName(),
+		Namespace: namespace,
+	}
+	err := api.Client.Get(api.Ctx, roleNN, role)
+	switch {
+	case err == nil:
+		if err := api.Client.Delete(api.Ctx, role); err != nil {
+			return err
+		}
+		return &RetryError{fmt.Errorf("deleted deprecated DevWorkspace Role")}
+	case k8sErrors.IsNotFound(err):
+		break
+	default:
+		return err
+	}
+	rolebinding := &rbacv1.RoleBinding{}
+	rolebindingNN := types.NamespacedName{
+		Name:      common.OldWorkspaceRolebindingName(),
+		Namespace: namespace,
+	}
+	err = api.Client.Get(api.Ctx, rolebindingNN, rolebinding)
+	switch {
+	case err == nil:
+		if err := api.Client.Delete(api.Ctx, rolebinding); err != nil {
+			return err
+		}
+		return &RetryError{fmt.Errorf("deleted deprecated DevWorkspace RoleBinding")}
+	case k8sErrors.IsNotFound(err):
+		break
+	default:
+		return err
+	}
+	return nil
+}