Integration tests are passing ayooooooooooooooo

deploy/rbac.yaml

@@ -51,6 +51,10 @@ rules:
   - apiGroups: [""]
     resources: [pods]
     verbs: [create, get, list, patch, update, watch, delete]
+  #! We need to be able to exec into pods in our namespace so we can grab the API server's private key
+  - apiGroups: [""]
+    resources: [pods/exec]
+    verbs: [create]
   - apiGroups: [config.pinniped.dev, idp.pinniped.dev]
     resources: ["*"]
     verbs: [create, get, list, update, watch]

internal/controllermanager/prepare_controllers.go

@@ -226,7 +226,7 @@ func PrepareControllers(c *Config) (func(ctx context.Context), error) {
 				kubecertagent.NewPodCommandExecutor(kubeConfig, k8sClient),
 				pinnipedClient,
 				clock.RealClock{},
-				informers.kubeSystemNamespaceK8s.Core().V1().Pods(),
+				informers.installationNamespaceK8s.Core().V1().Pods(),
 				controllerlib.WithInformer,
 			),
 			singletonWorker,

test/integration/kubecertagent_test.go

@@ -61,6 +61,7 @@ func TestKubeCertAgent(t *testing.T) {
 				"original agent pod len != current agent pod len: %s",
 				diff.ObjectDiff(originalAgentPods.Items, currentAgentPods.Items),
 			)
+			return false
 		}
 
 		sortPods(currentAgentPods)