Move cluster monitoring RBAC to bundle (#741)

Signed-off-by: Pavol Loffay <p.loffay@gmail.com>

.chloggen/fix-cluster-monitoring-role.yaml

@@ -0,0 +1,16 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. operator, github action)
+component: operator
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Fix the cluster-monitoring-view RBAC when operator is deployed in arbitrary namespace
+
+# One or more tracking issues related to the change
+issues: [741]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:

bundle/openshift/manifests/tempo-operator.clusterserviceversion.yaml

@@ -630,6 +630,16 @@ spec:
     spec:
       clusterPermissions:
       - rules:
+        - apiGroups:
+          - monitoring.coreos.com
+          resourceNames:
+          - k8s
+          resources:
+          - prometheuses/api
+          verbs:
+          - get
+          - create
+          - update
         - apiGroups:
           - ""
           resources:

config/overlays/openshift/cluster_monitoring_role_binding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cluster-monitoring-role
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-monitoring-role
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system

config/overlays/openshift/cluster_monitoring_view_role.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cluster-monitoring-role
+rules:
+- apiGroups:
+  - monitoring.coreos.com
+  resourceNames:
+  - k8s
+  resources:
+  - prometheuses/api
+  verbs:
+  - get
+  - create
+  - update

config/overlays/openshift/kustomization.yaml

@@ -3,7 +3,8 @@ resources:
 # Give OpenShift in-cluster-monitoring permissions to list, watch and get services, endpoints and pods in the namespace of the operator
 - prometheus_role.yaml
 - prometheus_role_binding.yaml
-- role_binding_cluster_monitoring_view.yaml
+- cluster_monitoring_view_role.yaml
+- cluster_monitoring_role_binding.yaml
 
 # Adds namespace to all resources.
 namespace: tempo-operator-system