Use system:kube-router User for clusterrole binding

[murali-reddy]

Kube-router as it provides service proxy as well, it has a chicken-egg problem (can not
access api server till it can setup service proxy), so service account are not usable. certificate generated for kube-router has CN system:kube-router, so user system:kube-router need to be given necessary RBAC permissions

Fixes #3463

[k8s-ci-robot]

Hi @murali-reddy. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[murali-reddy]

/assign @zmerlynn

[murali-reddy]

Is pull-kops-e2e-kubernetes-aws stuck? Is there any thing i have todo?

[chrislovecnm]

@liggitt or @erictune either of you guys have a chance to review? My RBAC-fu is not quite on par yet.

/ok-to-test

@murali-reddy e2e only starts for k8s members automatically. One of us has to add the above line for the bot to fire off the test. How many k8s prs have you done?

[murali-reddy]

@chrislovecnm 3 PR's so far all to the kops

[liggitt]

can add this as a second subject to the existing kube-router binding

 subjects:
- kind: ServiceAccount
  name: kube-router
  namespace: kube-system
- kind: User
  name: system:kube-router
  apiGroup: rbac.authorization.k8s.io

[chrislovecnm]

@murali-reddy nit pick but do we need apiGroup: rbac.authorization.k8s.io Write

[liggitt]

users don't have namespaces

[liggitt]

nit on combining subjects into a single binding, other changes look fine

[murali-reddy]

Updated the patch as per the comments. Thanks @liggitt

[chrislovecnm]

@liggitt really appreciate all of the RBAC reviews you do for us!

[justinsb]

/lgtm

[k8s-github-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

• OWNERS [justinsb]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[k8s-github-robot]

/test all [submit-queue is verifying that this PR is safe to merge]

[k8s-github-robot]

Automatic merge from submit-queue.