Added ADR for the provisioning functionality in KIM

[akgalwas]

Description

Changes proposed in this pull request:

• ADR describing provisioning functionality in the Kyma Infrastructure Manager

Related issue(s)
#125

[kyma-bot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[janmedrek]

Do you happen to have a structure for the RuntimeKubeconfig CR? I believe this is something that the Lifecycle Manager would need to consume. It would be great to set up a contract upfront.

[kwiatekus]

when configuring an additional workflow OIDC it will be common that cluster-admin role would need to be assigned to a "github identity" where the "user" field is configured to identify a certain github ref from a github repo, i.e :

kind: ClusterRoleBinding
...
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: actions-oidc:repo:myOrg/myRepo:ref:refs/heads/main

I checked that it is possible to pass such strings among administrators via KEB, for example

  "administrators": [
    "admin@mail.com",
    "actions-oidc:repo:myOrg/myRepo:ref:refs/heads/main"
  ]

.. so it should work.. but my gut feeling tells me it could be a bit confusing

@pbochynski @PK85
Is it ok from your point of view to mix users (identified by email) with workflow identities under one field "administrators" ?

[akgalwas]

Do you happen to have a structure for the RuntimeKubeconfig CR? I believe this is something that the Lifecycle Manager would need to consume. It would be great to set up a contract upfront.

@janmedrek You can find the structure here: https://github.com/kyma-project/infrastructure-manager/blob/main/api/v1/gardenercluster_types.go . At some point we will rename GardenerCluster CR to RuntimeKubeconfig

[pbochynski]

@pbochynski @PK85 Is it ok from your point of view to mix users (identified by email) with workflow identities under one field "administrators" ?

I think it is ok, but maybe we can have administrators in the additional OIDC config section. Then we do not need to add prefix in the list.

[akgalwas]

@pbochynski @PK85 Is it ok from your point of view to mix users (identified by email) with workflow identities under one field "administrators" ?

I think it is ok, but maybe we can have administrators in the additional OIDC config section. Then we do not need to add prefix in the list.

@pbochynski @kwiatekus I would go with the current proposal. I don't see a huge gain from adding administrators list under additional OIDC config (it also adds some confusion, as fields under spec.shoot are designed to be used solely for shoot generation)

[koala7659]

LGTM

[m00g3n]

LGTM