Rename many of resources that are created in Kubernetes by Pinniped

New resource naming conventions:
- Do not repeat the Kind in the name,
  e.g. do not call it foo-cluster-role-binding, just call it foo
- Names will generally start with a prefix to identify our component,
  so when a user lists all objects of that kind, they can tell to which
  component it is related,
  e.g. `kubectl get configmaps` would list one named "pinniped-config"
- It should be possible for an operator to make the word "pinniped"
  mostly disappear if they choose, by specifying the app_name in
  values.yaml, to the extent that is practical (but not from APIService
  names because those are hardcoded in golang)
- Each role/clusterrole and its corresponding binding have the same name
- Pinniped resource names that must be known by the server golang code
  are passed to the code at run time via ConfigMap, rather than
  hardcoded in the golang code. This also allows them to be prepended
  with the app_name from values.yaml while creating the ConfigMap.
- Since the CLI `get-kubeconfig` command cannot guess the name of the
  CredentialIssuerConfig resource in advance anymore, it lists all
  CredentialIssuerConfig in the app's namespace and returns an error
  if there is not exactly one found, and then uses that one regardless
  of its name

deploy/deployment.yaml

@@ -14,7 +14,7 @@ metadata:
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: #@ data.values.app_name + "-service-account"
+  name: #@ data.values.app_name
   namespace: #@ data.values.namespace
 ---
 apiVersion: v1
@@ -25,6 +25,7 @@ metadata:
   labels:
     app: #@ data.values.app_name
 data:
+  #! If names.apiService is changed in this ConfigMap, must also change name of the ClusterIP Service resource below.
   #@yaml/text-templated-strings
   pinniped.yaml: |
     discovery:
@@ -33,6 +34,10 @@ data:
       servingCertificate:
         durationSeconds: (@= str(data.values.api_serving_certificate_duration_seconds) @)
         renewBeforeSeconds: (@= str(data.values.api_serving_certificate_renew_before_seconds) @)
+    names:
+      servingCertificateSecret: (@= data.values.app_name + "-api-tls-serving-certificate" @)
+      credentialIssuerConfig: (@= data.values.app_name + "-config" @)
+      apiService: (@= data.values.app_name + "-api" @)
 ---
 #@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
 apiVersion: v1
@@ -66,7 +71,7 @@ spec:
       annotations:
         scheduler.alpha.kubernetes.io/critical-pod: ""
     spec:
-      serviceAccountName: #@ data.values.app_name + "-service-account"
+      serviceAccountName: #@ data.values.app_name
       #@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
       imagePullSecrets:
         - name: image-pull-secret
@@ -144,7 +149,8 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  name: pinniped-api #! the golang code assumes this specific name as part of the common name during cert generation
+  #! If name is changed, must also change names.apiService in the ConfigMap above
+  name: #@ data.values.app_name + "-api"
   namespace: #@ data.values.namespace
   labels:
     app: #@ data.values.app_name

deploy/rbac.yaml

@@ -8,7 +8,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: #@ data.values.app_name + "-aggregated-api-server-cluster-role"
+  name: #@ data.values.app_name + "-aggregated-api-server"
 rules:
   - apiGroups: [""]
     resources: [namespaces]
@@ -23,14 +23,14 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: #@ data.values.app_name + "-aggregated-api-server-cluster-role-binding"
+  name: #@ data.values.app_name + "-aggregated-api-server"
 subjects:
   - kind: ServiceAccount
-    name: #@ data.values.app_name + "-service-account"
+    name: #@ data.values.app_name
     namespace: #@ data.values.namespace
 roleRef:
   kind: ClusterRole
-  name: #@ data.values.app_name + "-aggregated-api-server-cluster-role"
+  name: #@ data.values.app_name + "-aggregated-api-server"
   apiGroup: rbac.authorization.k8s.io
 
 #! Give permission to various objects within the app's own namespace
@@ -38,7 +38,7 @@ roleRef:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: #@ data.values.app_name + "-aggregated-api-server-role"
+  name: #@ data.values.app_name + "-aggregated-api-server"
   namespace: #@ data.values.namespace
 rules:
   - apiGroups: [""]
@@ -54,15 +54,15 @@ rules:
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: #@ data.values.app_name + "-aggregated-api-server-role-binding"
+  name: #@ data.values.app_name + "-aggregated-api-server"
   namespace: #@ data.values.namespace
 subjects:
   - kind: ServiceAccount
-    name: #@ data.values.app_name + "-service-account"
+    name: #@ data.values.app_name
     namespace: #@ data.values.namespace
 roleRef:
   kind: Role
-  name: #@ data.values.app_name + "-aggregated-api-server-role"
+  name: #@ data.values.app_name + "-aggregated-api-server"
   apiGroup: rbac.authorization.k8s.io
 
 #! Give permission to list pods and pod exec in the kube-system namespace so we can find the API server's private key
@@ -70,7 +70,7 @@ roleRef:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: #@ data.values.app_name + "-kube-system-pod-exec-role"
+  name: #@ data.values.app_name + "-kube-system-pod-exec"
   namespace: kube-system
 rules:
   - apiGroups: [""]
@@ -83,23 +83,23 @@ rules:
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: #@ data.values.app_name + "-kube-system-pod-exec-role-binding"
+  name: #@ data.values.app_name + "-kube-system-pod-exec"
   namespace: kube-system
 subjects:
   - kind: ServiceAccount
-    name: #@ data.values.app_name + "-service-account"
+    name: #@ data.values.app_name
     namespace: #@ data.values.namespace
 roleRef:
   kind: Role
-  name: #@ data.values.app_name + "-kube-system-pod-exec-role"
+  name: #@ data.values.app_name + "-kube-system-pod-exec"
   apiGroup: rbac.authorization.k8s.io
 
-#! Allow both authenticated and unauthenticated CredentialRequests (i.e. allow all requests)
+#! Allow both authenticated and unauthenticated TokenCredentialRequests (i.e. allow all requests)
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: #@ data.values.app_name + "-credentialrequests-cluster-role"
+  name: #@ data.values.app_name + "-create-token-credential-requests"
 rules:
   - apiGroups: [pinniped.dev]
     resources: [credentialrequests]
@@ -111,7 +111,7 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: #@ data.values.app_name + "-credentialrequests-cluster-role-binding"
+  name: #@ data.values.app_name + "-create-token-credential-requests"
 subjects:
   - kind: Group
     name: system:authenticated
@@ -121,7 +121,7 @@ subjects:
     apiGroup: rbac.authorization.k8s.io
 roleRef:
   kind: ClusterRole
-  name: #@ data.values.app_name + "-credentialrequests-cluster-role"
+  name: #@ data.values.app_name + "-create-token-credential-requests"
   apiGroup: rbac.authorization.k8s.io
 
 #! Give permissions for subjectaccessreviews, tokenreview that is needed by aggregated api servers
@@ -129,11 +129,11 @@ roleRef:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: #@ data.values.app_name + "-service-account-cluster-role-binding"
+  name: #@ data.values.app_name
   namespace: #@ data.values.namespace
 subjects:
   - kind: ServiceAccount
-    name: #@ data.values.app_name + "-service-account"
+    name: #@ data.values.app_name
     namespace: #@ data.values.namespace
 roleRef:
   kind: ClusterRole
@@ -145,11 +145,11 @@ roleRef:
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: #@ data.values.app_name + "-extension-apiserver-authentication-reader-role-binding"
+  name: #@ data.values.app_name + "-extension-apiserver-authentication-reader"
   namespace: kube-system
 subjects:
   - kind: ServiceAccount
-    name: #@ data.values.app_name + "-service-account"
+    name: #@ data.values.app_name
     namespace: #@ data.values.namespace
 roleRef:
   kind: Role
@@ -161,7 +161,7 @@ roleRef:
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: #@ data.values.app_name + "-cluster-info-lister-watcher-role"
+  name: #@ data.values.app_name + "-cluster-info-lister-watcher"
   namespace: kube-public
 rules:
   - apiGroups: [""]
@@ -171,13 +171,13 @@ rules:
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: #@ data.values.app_name + "-cluster-info-lister-watcher-role-binding"
+  name: #@ data.values.app_name + "-cluster-info-lister-watcher"
   namespace: kube-public
 subjects:
   - kind: ServiceAccount
-    name: #@ data.values.app_name + "-service-account"
+    name: #@ data.values.app_name
     namespace: #@ data.values.namespace
 roleRef:
   kind: Role
-  name: #@ data.values.app_name + "-cluster-info-lister-watcher-role"
+  name: #@ data.values.app_name + "-cluster-info-lister-watcher"
   apiGroup: rbac.authorization.k8s.io