[RFE] ease the management of RBAC for routes using externalCertificate

Hi,

I hope this is an OK-way to submit potential ideas.

We recently discovered the new .spec.tls.externalCertificate route field, which we have been hoping for some time. Great to see it's now there.
The little pain point, though, is for the user to have to manage the role and rolebinding to give the router SA access to the secret.

For that part, we were thinking that could maybe be simplified by introducing a new annotation, for example, at the secret-level?

So the user would only need to add a specific annotation to his/her secrets which contain an external certificate used in routes.
When detected, the names of those secrets would automatically be put inside the role's resourceNames field.
That role and corresponding rolebinding would also be managed by the same operator watching if secrets have this annotation

Compared to today the "only" change would be that the required role and rolebinding would be automatically created if at least one secret in the namespace has that special annotation, and the content of that role's resourceNames would always be the concatenated list of names of such secrets.

Would something like this be conceivable, or not at all?

@thejasn @chiragkyal as I see you're the authors of
https://github.com/openshift/enhancements/blob/master/enhancements/ingress/route-secret-injection-for-external-certificate-management.md

Thanks

Start with enhancements/ingress/route-secret-injection-for-external-certificate-management.md and trace the existing handling of route externalCertificate secrets and their RBAC resources. Define and implement the proposed secret annotation, automatic role and rolebinding management, and resourceNames updates, with coverage for adding and removing annotated secrets.