Removes privilege-escalation permissions from RBAC manifest per PRI-554
QA review. The rbac.authorization.k8s.io rule now grants only
get/list/watch on rolebindings (needed for deploy script to verify
existing bindings exist).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
kubectl apply requires get/list/watch on roles/rolebindings to check
existing state before patching. Without these, apply fails with
Forbidden on the GET call itself.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Adds deployment/e2e-ci-runner-rbac.yaml which grants the Arc Runners
service account the minimum permissions needed to deploy/teardown an
E2E Headlamp instance in privilegedescalation-dev.
Fixes PRI-550.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Chris Farhood