BumpClusterImageRoleAuthorizations will bump the failing apps covered by a cluster image role authorization such that the app will be re-evaluated for image permissions.

BumpImageRoleAuthorizations will bump the failing apps covered by an image role authorization such that the app will be re-evaluated for image permissions.

CheckPermissions checks various things related to permissions a) if the image is allowed by the image allow rules (if enabled) b) [if ImageRoleAuthorizations are enabled] if the authorized permissions for the appImage cover the permissions granted explicitly by the user or implicitly to the image (Authorized >= Granted) c) if the permissions granted by the user or implicitly to the image cover the permissions requested by the app (Granted >= Requested) *Note*: One thing that we do not cover here is permissions consumed from a service.

CopyPromoteStagedAppImage copies the staged app image to the app image if - the staged app image is set - the permissions have been checked - there are no missing permissions - there are no image permissions denied (if ImageRoleAuthorizations are enabled) - the image is allowed by the image allow rules (if enabled).

GetConsumerPermissions returns the permissions for a given container augmented with permissions from any services it depends on that expose consumer permissions.