Fix RBAC generation to include namespaces list and watch

Also add checking manifests to github PR CI

Signed-off-by: Angel Misevski <[email protected]>

Author: amisevsk

.github/workflows/pr.yml

@@ -57,6 +57,19 @@ jobs:
           echo "not well formatted sources are found"
           exit 1
         fi
+    -
+      name: Check manifests
+      run: |
+        git reset HEAD --hard
+        pip install yq
+        # Note: fmt is necessary after generate since generated sources will
+        #       fail format check by default.
+        make generate fmt manifests
+        if [[ ! -z $(git status -s) ]]
+        then
+          echo "generated sources are not up to date"
+          exit 1
+        fi
     -
       name: Run Go Tests
       run: |

controllers/workspace/devworkspace_controller.go

@@ -65,7 +65,7 @@ type DevWorkspaceReconciler struct {
 /////// Required permissions for controller
 // +kubebuilder:rbac:groups=apps;extensions,resources=deployments;replicasets,verbs=*
 // +kubebuilder:rbac:groups="",resources=pods;serviceaccounts;secrets;configmaps;persistentvolumeclaims,verbs=*
-// +kubebuilder:rbac:groups="",resources=namespaces,verbs=get
+// +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list;watch
 // +kubebuilder:rbac:groups="batch",resources=jobs,verbs=get;create;list;watch;update;patch;delete
 // +kubebuilder:rbac:groups=admissionregistration.k8s.io,resources=mutatingwebhookconfigurations;validatingwebhookconfigurations,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings;clusterroles;clusterrolebindings,verbs=get;list;watch;create;update