feat: Remove ClusterRole

[ChandonPierre]

Some managed k8s offerings do not allow installing cluster scoped resources

This PR allows for an entirely namespace scoped installation (if .Values.serviceAccount.clusterRoleBinding is not provided it defaults to true)

~~ We do this with kustomize today, would be nice to have support in the chart 😄 ~~

So after some testing with removing the clusterrole, I can indeed do k auth can-i list customresourcedefinitions --as system:serviceaccount:authentik:authentik successfully, meaning that the role still gives access to read CRDs

Does not appear to be required to list CRDs 😄

[BeryJu]

The clusterrole is required for the authentik kubernetes outpost integration to fully work, without it authentik can't detect what is installed in your cluster and if authentik needs to create any special traefik/etc config (also I'm curious what kind of K8s provider doesn't allow for ClusterRoles)

[ChandonPierre]

The clusterrole is required for the authentik kubernetes outpost integration to fully work, without it authentik can't detect what is installed in your cluster and if authentik needs to create any special traefik/etc config

Using the namespace scoped Role + the authentik sa token, I'm still able to GET CRDs:

helm/charts/authentik-remote-cluster/templates/role.yaml

Lines 43 to 48 in ce268f3

	- apiGroups:
	- apiextensions.k8s.io
	resources:
	- customresourcedefinitions
	verbs:
	- list

For a fully namespace scoped installation, I'm not sure I understand what the ClusterRole is needed for since it seems to provide the same RBAC

helm/charts/authentik-remote-cluster/templates/cluster-role.yaml

Lines 12 to 18 in ce268f3

	rules:
	- apiGroups:
	- apiextensions.k8s.io
	resources:
	- customresourcedefinitions
	verbs:
	- list

(also I'm curious what kind of K8s provider doesn't allow for ClusterRoles)

Currently the CoreWeave Kubernetes offering does not allow for ClusterRoles (though this will be changed in the future)

[BeryJu]

So after some testing with removing the clusterrole, I can indeed do k auth can-i list customresourcedefinitions --as system:serviceaccount:authentik:authentik successfully, meaning that the role still gives access to read CRDs; I'm trying to find this behaviour mentioned in the K8s docs as those mention that a ClusterRole is used to access non-namespaced resources such as the CR definition (https://kubernetes.io/docs/reference/access-authn-authz/rbac/)

With this we could basically remove the ClusterRole completely, since the only reason for its existence was to read the CRDs

[ChandonPierre]

With this we could basically remove the ClusterRole completely, since the only reason for its existence was to read the CRDs

Even better 😃