Fixed the default ArgoCD role for default instance openshift-gitops

[anandf]

What type of PR is this?

Uncomment only one /kind line, and delete the rest.
For example, > /kind bug would simply become: /kind bug
/kind enhancement
/kind bug
/kind cleanup
/kind failing-test
/kind enhancement
/kind documentation
/kind code-refactoring

What does this PR do / why we need it:
This PR is to make the default ArgoCD instance with name openshift-gitops in namespace openshift-gitops to have restricted default permissions. With default readonly permission, any non-admin user will be able to view the Application and other manifest resource managed by ArgoCD which can contain sensitive information. By setting the default permission to '' this read only access can be avoided.

Have you updated the necessary documentation?

• Documentation update is required by this PR.
• Documentation has been updated.

Which issue(s) this PR fixes:

Fixes #?

Test acceptance criteria:

• Unit Test
• E2E Test

How to test changes / Special notes to the reviewer:

[anandf]

/test v4.14-kuttl-sequential-periodic

[anandf]

/test v4.13-e2e

[anandf]

/test v4.14-kuttl-parallel

[jaideepr97]

@anandf could this be a breaking change for users that haven't specifically defined their argocd rbac because the default policy was already letting them do what they needed ? Not that that is a reason not to make this change

[anandf]

@anandf could this be a breaking change for users that haven't specifically defined their argocd rbac because the default policy was already letting them do what they needed ? Not that that is a reason not to make this change

I agree that this change can cause surprise in behaviour especially if customers were leveraging this default read only role. Would it be sufficient to mention this change in behaviour in the release notes ? Please not that this change being applicable only for the default gitops instance and other customer managed ArgoCD instances will continue working as before.

[anandf]

/retest-required

[jaideepr97]

LGTM, thanks @anandf

[anandf]

/test v4.13-kuttl-parallel

[anandf]

/test v4.13-kuttl-parallel

[iam-veeramalla]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: iam-veeramalla

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [iam-veeramalla]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment