Provide a less permissive ClusterRole for cross-namespace references

[jcanseco]

Describe the feature or the resource that you want.

Config Connector requires that you apply a RoleBinding to allow for cross-namespace references when in namespaced-mode (source).

Request: Could Config Connector provide a less permissive ClusterRole than cnrm-admin for such a purpose (e.g. a cnrm-viewer role)? The cnrm-admin role grants read/write and seems a bit overkill for the purpose.

Context: #320 (comment)

[karlkfi]

KCC v1.45.0 now includes the cnrm-viewer ClusterRole, tho it seems to have been left out of the release notes.

Docs were updated tho:
https://cloud.google.com/config-connector/docs/how-to/creating-resource-references#cross-namespace_references

[jcanseco]

Yep, thanks @karlkfi! Closing.

it seems to have been left out of the release notes

Was gonna add it, but it seems like it was mentioned by this line: Supported a viewer cluster role so that resources can be referenced cross namespaces in namespaced mode. (#407)