Add annotation for setting access mode on automounted configmap/secret files

[amisevsk]

What does this PR do?

Adds secret/configmap automount annotation

controller.devfile.io/mount-access-mode

that can be used to configure file permissions on files mounted from the secret/configmap. Access mode is propagated into merged projected volumes as well.

What issues does this PR fix or reference?

Closes #1072

Is it tested? How?

To test manually, see files below

yaml resources

• Plain configmap (mounted to /tmp/access-mode/configmap/):

  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: test-cm-accessmode
    labels:
      controller.devfile.io/mount-to-devworkspace: "true"
      controller.devfile.io/watch-configmap: 'true'
    annotations:
      controller.devfile.io/mount-as: file
      controller.devfile.io/mount-path: /tmp/access-mode/configmap/
      controller.devfile.io/mount-access-mode: "0777"
  data:
    cm-test.sh: |
      #!/bin/bash
  
      echo "I am a configmap"

• Plain secret (mounted to /tmp/access-mode/secret/):

  apiVersion: v1
  kind: Secret
  metadata:
    name: test-secret-accessmode
    labels:
      controller.devfile.io/mount-to-devworkspace: "true"
      controller.devfile.io/watch-secret: 'true'
    annotations:
      controller.devfile.io/mount-as: file
      controller.devfile.io/mount-path: /tmp/access-mode/secret/
      controller.devfile.io/mount-access-mode: "0777"
  type: Opaque
  data:
    # Contents:
    # #!/bin/bash
    #
    # echo "I am a secret"
    secret-test.sh: IyEvYmluL2Jhc2gKCmVjaG8gIkkgYW0gYSBzZWNyZXQiCg==

• Projected configmaps and secrets, with different access modes (mounted to /tmp/access-mode/projected/):

  apiVersion: v1
  kind: Secret
  metadata:
    name: test-secret-accessmode-projected
    labels:
      controller.devfile.io/mount-to-devworkspace: "true"
      controller.devfile.io/watch-secret: 'true'
    annotations:
      controller.devfile.io/mount-as: file
      controller.devfile.io/mount-path: /tmp/access-mode/projected/
      controller.devfile.io/mount-access-mode: "0777"
  type: Opaque
  data:
    secret-test.sh: IyEvYmluL2Jhc2gKCmVjaG8gIkkgYW0gYSBzZWNyZXQiCg==
  ---
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: test-cm-accessmode-projected-1
    labels:
      controller.devfile.io/mount-to-devworkspace: "true"
      controller.devfile.io/watch-configmap: 'true'
    annotations:
      controller.devfile.io/mount-as: file
      controller.devfile.io/mount-path: /tmp/access-mode/projected/
      controller.devfile.io/mount-access-mode: "0776"
  data:
    cm-test-2.sh: |
      #!/bin/bash
  
      echo "I am a configmap 2"
  ---
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: test-cm-accessmode-projected-2
    labels:
      controller.devfile.io/mount-to-devworkspace: "true"
      controller.devfile.io/watch-configmap: 'true'
    annotations:
      controller.devfile.io/mount-as: file
      controller.devfile.io/mount-path: /tmp/access-mode/projected/
      controller.devfile.io/mount-access-mode: "0774"
  data:
    cm-test-1.sh: |
      #!/bin/bash
  
      echo "I am a configmap 1"

PR Checklist

• E2E tests pass (when PR is ready, comment /test v8-devworkspace-operator-e2e, v8-che-happy-path to trigger)
  • v8-devworkspace-operator-e2e: DevWorkspace e2e test
  • v8-che-happy-path: Happy path for verification integration with Che

[codecov]

Codecov Report

Patch coverage: 76.54% and project coverage change: +2.67 🎉

Comparison is base (bd7a091) 51.48% compared to head (a311d86) 54.16%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1074      +/-   ##
==========================================
+ Coverage   51.48%   54.16%   +2.67%     
==========================================
  Files          76       76              
  Lines        6606     6680      +74     
==========================================
+ Hits         3401     3618     +217     
+ Misses       2939     2778     -161     
- Partials      266      284      +18     

Impacted Files	Coverage Δ
pkg/provision/automount/secret.go	82.35% <62.50%> (+46.41%)	⬆️
pkg/provision/automount/configmap.go	86.17% <77.41%> (+42.23%)	⬆️
pkg/provision/automount/common.go	68.46% <86.36%> (+34.80%)	⬆️
pkg/provision/automount/gitconfig.go	62.61% <100.00%> (+23.36%)	⬆️
pkg/provision/automount/projected.go	96.61% <100.00%> (+1.78%)	⬆️

... and 2 files with indirect coverage changes

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

[AObuchow]

Tested out the sample configmaps/secrets and was able to execute them as expected. Code looks good to me as well. I'll let you add the automated tests and re-review then.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amisevsk, AObuchow, ibuziuk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [amisevsk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

New changes are detected. LGTM label has been removed.

[amisevsk]

/retest

[amisevsk]

Prow tests are failing due to kislyuk/yq#165

[AObuchow]

/retest