[RBAC] Adjust system:kube-dns rules for configmaps

Without additional rules we are getting the following error in
contrainer:
E0205 09:11:38.505998       1 dns.go:183] Error getting initial
ConfigMap: configmaps "kube-dns" is forbidden: User
"system:serviceaccount:kube-system:kube-dns" cannot get configmaps in
the namespace "kube-system", starting with default values

We doesn't have configmap for kubedns atm, but this patch will save
some time for those who will create configmap for any other purposes.

Change-Id: I1c0cafab735059cb66cd892b9ecfceb29469fd44

kubernetes/files/kube-addons/dns/kubedns-clusterrole.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    addonmanager.kubernetes.io/mode: Reconcile
+    kubernetes.io/bootstrapping: rbac-defaults
+  name: "system:kube-dns"
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  - services
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch

kubernetes/master/kube-addons.sls

@@ -198,6 +198,14 @@ addon-dir-create:
     - dir_mode: 755
     - makedirs: True
 
+/etc/kubernetes/addons/dns/kubedns-clusterrole.yaml:
+  file.managed:
+    - source: salt://kubernetes/files/kube-addons/dns/kubedns-clusterrole.yaml
+    - template: jinja
+    - group: root
+    - dir_mode: 755
+    - makedirs: True
+
 {% endif %}
 
 {% endif %}