Create/Update ClusterRoles just once?

[joelanford]

If I understand the existing code correctly, it looks like we currently call ensureClusterRoles in a loop for each scope template that references the scope template we're reconciling.

https://github.com/awgreene/oria-operator/blob/9594791bb669df7572f353346ffd85ee0460bfc7/controllers/scopetemplate_controller.go#L96-L100

This will cause a bunch of unnecessary chatter with the API server because we'll end up sending a bunch of redundant update calls after the first one.

Instead, perhaps we should call ensureClusterRoles once behind a check for len(scopeInstancesThatReferenceScopeTemplate) > 0?

[everettraven]

@joelanford I noticed a break here in that loop
https://github.com/awgreene/oria-operator/blob/9594791bb669df7572f353346ffd85ee0460bfc7/controllers/scopetemplate_controller.go#L110

My understanding of the existing code is that once a ScopeInstance is found to reference the ScopeTemplate being reconciled it will create/update ClusterRoles using the ensureClusterRoles and then break

[joelanford]

You're right! Totally missed that.

So a total nit at this point but a comment at the top of that loop could be helpful to explain what's happening.

[everettraven]

👍 I agree with adding a comment