be able to use secrets for credentials

[jmazzitelli]

A PoC that allows endpoint credentials to refer to a OS secret.

[pilhuhn]

This works for me. I have a secret like this:
echo -n "test4hawkular" | base64 # create the password
and then

$ less ~/hosa-secret.yml
apiVersion: v1
kind: Secret
metadata:
  name: hosa-secret
type: Opaque
data:
  password: dGVzdDRoYXdrdWxhcg==

This is referenced in the java-exec container's ENV

 containers:
        - env:
          - name: AB_JOLOKIA_PASSWORD_RANDOM
            value: "false"
          - name: AB_JOLOKIA_PASSWORD
            valueFrom:
              secretKeyRef:
                name: hosa-secret
                key: password

and also in the config-map for the agent:

      credentials:
        username: jolokia
        password: secret:hosa-secret/password

[jmazzitelli]

I just changed this so it creates our own clusterrole that just gives "get/secrets" permission. It gets assigned to our service account. I tested it and it works.

[jmazzitelli]

I took out the granting of the full cluster-reader role. We do not need the vast majority of the permissions cluster-reader provides. So, instead, I create much more limited cluster role and assign only that role to the agent. I tested it and it looks to be working. See the deploy/openshift/hawkular-openshift-agent.yaml for the ClusterRole that is created.

[jmazzitelli]

This line that deletes the cluster role can be deleted once this is fixed: openshift/origin#12450
There is already a PR that fixes it, just wait for it to be merged: openshift/origin#12461