RBAC overhaul

[alex-bezek]

related: #K8SOP-246

What

Overhauls RBAC across all three operator deployments (api-manager, agent-manager, bindings-forwarder) to:

1. Hand-manage all RBAC in Helm templates — removes controller-gen RBAC generation and all 73 kubebuilder:rbac markers from Go code. This follows the pattern used by cert-manager, Kyverno, ArgoCD, and other multi-deployment operators.
2. Reorganize into per-component directories — each deployment's templates (deployment, SA, RBAC) live in their own directory (api-manager/, agent/, bindings-forwarder/).
3. Add namespace-scoping support — when watchNamespace is set, namespace-scoped resources use a Role instead of a ClusterRole. Cluster-scoped resources (namespaces, ingressclasses, gatewayclasses) remain in a ClusterRole.
4. Fix all known RBAC bugs (see below).

How

Bug fixes

• Delete 4 stale CRD access roles referencing non-existent CRDs (bindingconfiguration, operatorconfiguration)
• Fix boundendpoint editor/viewer roles — wrong API group (ngrok.k8s.ngrok.com → bindings.k8s.ngrok.com)
• Remove dead proxy-role ClusterRole (leftover kube-rbac-proxy scaffolding)
• Fold secret-manager-role into api-manager role (add secret create/update/patch)
• Remove stale tunnels rules from agent ClusterRole (Tunnel CRD no longer exists)
• Remove duplicate events rule from bindings-forwarder
• Remove misapplied clusterRole.annotations from operator-internal roles

Restructure

• Move controller-*.yaml templates into templates/api-manager/ directory
• Split monolithic RBAC files into per-resource files (role.yaml, rolebinding.yaml, etc.)
• Rename service-account.yaml → serviceaccount.yaml for consistency
• Move CRD access roles into templates/rbac/crd-access/ with consistent naming
• Add missing CRD access roles for AgentEndpoint, KubernetesOperator, NgrokTrafficPolicy

Go / build changes

• Remove all 73 +kubebuilder:rbac markers from 18 Go files (comment-only changes)
• Remove rbac:roleName=... and output:rbac:... from controller-gen command in generate.mk

values.yaml

• Rename clusterRole → crdAccessRoles (only applies to CRD access editor/viewer roles)
• Add crdAccessRoles.create toggle

Namespace-scoping

• New isNamespaced and watchNamespace helpers in _helpers.tpl
• Each component gets role.yaml (ClusterRole, default) and role-namespaced.yaml (Role, watchNamespace) with simple if/if not guards
• api-manager splits into: Role (namespace-scoped resources) + ClusterRole (cluster-scoped resources) in watchNamespace mode

Verification

• RBAC baseline captured from kind cluster before refactor (specs/rbac/)
• After refactor: redeployed, diffed kubectl auth can-i --list per SA against baseline
• All intentional diffs documented in design doc

Breaking Changes

• clusterRole.annotations renamed to crdAccessRoles.annotations in values.yaml. Users setting this value will need to update their Helm values.
• proxy-role ClusterRole removed (grants tokenreviews and subjectaccessreviews). This was dead scaffolding from kube-rbac-proxy which was never deployed. No functional impact.
• Bindings-forwarder pods ClusterRole removed — pods access moved to the namespaced Role. Only affects users who relied on the forwarder reading pods across namespaces (it doesn't — it only watches pods in its own namespace).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 52.75%. Comparing base (962d5d7) to head (7277ea7).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #804      +/-   ##
==========================================
- Coverage   53.38%   52.75%   -0.64%     
==========================================
  Files         101      101              
  Lines       11325    11325              
==========================================
- Hits         6046     5974      -72     
- Misses       4852     4908      +56     
- Partials      427      443      +16     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.