[kong] RBAC for single-namepsace deployments

[rainest]

See the scenario described in https://discuss.konghq.com/t/clusterrole-and-clusterrolebinding-creation/6435/2?u=traines

Using --watch-namespace should allow for Kong deployments that do not create any ClusterRole for their ServiceAccount, instead placing all permissions into the namespaced Role. However, this is not tested and should be coordinated with the controller (not strictly required, but it should probably have its own Role-only example manifest that the chart tracks).

CRDs are always cluster-wide, but are easier to manage separately (as-is, Helm 3 always manages them separately, and only has the ability to create them alongside the release for convenience--the CRDs are not part of the release). The (Cluster)RoleBinding, by comparison, is tied to a specific ServiceAccount, so it needs to be part of the release for the template to bind it correctly.

Proposed changes:

• Add a new "single namespace" configuration property somewhere in values.yaml (probably top-level, since there are some cases where we use the ServiceAccount for non-controller configuration).
• If the new property is disabled, deploy RBAC resources as they are now.
• If the new property is enabled, do not create a ClusterRole or ClusterRoleBinding, and include all permissions that would normally exist in the ClusterRole in the Role, minus KongClusterPlugin (there may be other cluster resources that we'd normally have access to and can't use in a single namespace context).

This is probably contingent on Kong/kubernetes-ingress-controller#717

[andrevtg]

This would be awesome. I am currently able to use Kong in restrained environments (like Okteto) by patching both the chart and the ingress controller code (as mentioned in Kong/kubernetes-ingress-controller#717).

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[rainest]

Handled via watchNamespaces with controller 2.0+