Support scale subresource for PDBs (#76294)

* Support scale subresource for PDBs

* Check group in finder functions

* Small fixes and more tests

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go

@@ -138,6 +138,7 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding)
 			rbacv1helpers.NewRule("get", "list", "watch").Groups(policyGroup).Resources("poddisruptionbudgets").RuleOrDie(),
 			rbacv1helpers.NewRule("get", "list", "watch").Groups(appsGroup).Resources("statefulsets").RuleOrDie(),
 			rbacv1helpers.NewRule("update").Groups(policyGroup).Resources("poddisruptionbudgets/status").RuleOrDie(),
+			rbacv1helpers.NewRule("get").Groups("*").Resources("*/scale").RuleOrDie(),
 			eventsRule(),
 		},
 	})

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy_test.go

@@ -33,6 +33,7 @@ var rolesWithAllowStar = sets.NewString(
 	saRolePrefix+"resourcequota-controller",
 	saRolePrefix+"horizontal-pod-autoscaler",
 	saRolePrefix+"clusterrole-aggregation-controller",
+	saRolePrefix+"disruption-controller",
 )
 
 // TestNoStarsForControllers confirms that no controller role has star verbs, groups,

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml

@@ -382,6 +382,12 @@ items:
     - poddisruptionbudgets/status
     verbs:
     - update
+  - apiGroups:
+    - '*'
+    resources:
+    - '*/scale'
+    verbs:
+    - get
   - apiGroups:
     - ""
     resources: