checkpointer: update image and drop permissions from ClusterRole to Role

[ericchiang]

The checkpointer now only watches pods in kube-system (#774), so it
doesn't need cluster wide permissions.

/assign @dghubble

[ericchiang]

coreosbot run e2e checkpointer

[dghubble]

Should be able to drop the old TODO: https://github.com/kubernetes-incubator/bootkube/blob/master/pkg/asset/internal/templates.go#L447

[dghubble]

I meant for that to be a comment, but lgtm on green.

[ericchiang]

TODO dropped

[ericchiang]

@dghubble I built the checkpointer image https://quay.io/repository/coreos/pod-checkpointer?tab=tags

This seems like it might be a real bug or an issue with the test

[1885717.463307] golang[5]: === RUN   TestCheckpointerUnscheduleCheckpointer
[1886374.516081] golang[5]: --- FAIL: TestCheckpointerUnscheduleCheckpointer (657.05s)
[1886374.519511] golang[5]: 	checkpointer_test.go:212: Failed to verify checkpoint: unable to ls "/etc/kubernetes/checkpoint-secrets/bootkube-e2e-58fcd56c-testcheckpointerunschedulecheckpointer", error: Process exited with status 2
[1886374.519933] golang[5]: 		stdout:
[1886374.520211] golang[5]: 		stderr: ls: cannot access '/etc/kubernetes/checkpoint-secrets/bootkube-e2e-58fcd56c-testcheckpointerunschedulecheckpointer': No such file or directory

[ericchiang]

The tests deploy pods into namespaces that aren't kube-system.

Going to modify the tests to look for existing configmaps and secrets we know are deployed into kube-system. e.g the kube-apiserver and kubeconfig-in-cluster secrets.

[dghubble]

Are we still waiting on this for bootkube v0.9.0?

[diegs]

Commit was merged in #784