Replace namespaced roles with cluster role

[djzager]

Instead of creating roles in the openshift-console and kube-public
namespaces + associated role bindings, give the operator permission to
access configmaps in all namespaces.

This makes it possible, in a follow-up PR, to generate a CSV so that
web-ui is installable via OLM.

[mareklibra]

I don't like granting wider permissions than required, especially something like permission to read/write all configmaps in all namespaces.

David, can you please briefly explain why is this needed by the "CSV generator"?

[djzager]

In a ClusterServiceVersion (CSV) you specify permissions and clusterPermissions that basically map a collection of rules to a service account name. When your CSV is installed the service account is created with the name you specified in the namespace where the Subscription is made. You cannot create Roles or ServiceAccounts in other namespaces and you cannot bind a Service Account to a Role in another namespace.

https://github.com/operator-framework/operator-lifecycle-manager/blob/master/Documentation/design/building-your-csv.md#operator-install

[mareklibra]

@djzager , ok, thanks for the explanation.