RBAC for console backend to request openshift-config-managed configmaps

[jhadvig]

Adding:

• Role for GETting ConfigMaps from the openshift-config-managed namespace. Haven't found any existing Role on the cluster that would be suitable.
• ServiceAccount for the console, since there are only default ServiceAccounts in the openshift-console namespace
• RoleBinding - for binding the added Role and ServiceAccount

Story: https://issues.redhat.com/browse/CONSOLE-1993

/assign @benjaminapetersen

[benjaminapetersen]

So currently we have:

oc get role -n openshift-config-managed
NAME               AGE
console-operator   28h
console-public     28h
machine-approver   28h

For this reason I'm inclined to name it console-configmap-reader. Since its in openshift-config-managed namespace. That would give us:

oc get role -n openshift-config-managed
NAME                              AGE
console-configmap-reader          28h
console-operator                  28h
console-public                    28h
machine-approver                  28h

[benjaminapetersen]

We did speak about console-public being somewhat "different" as its more for other components being able to get the console-public configmap so those components can oc get configmap console-public -n openshift-config-managed --template '{{.data.consoleURL}}' and use the console url value. This is probably fine.

[jhadvig]

@benjaminapetersen PR updated, set the console podSpec to use the console ServiceAccount. Tokens are mounted automatically.

[benjaminapetersen]

/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: benjaminapetersen, jhadvig

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [benjaminapetersen]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment