fix: add custom clusterrole for ccm helm chart

[hegerdes]

This adds a new ClusterRole to the ccm helm chart and implements the least privilege principle for ccm rbac permissions.

The values are mostly taken from the aws ccm and k8s docs but I added ConfigMap permissions since hcloud ccm needs them.

The following SA permissions are not strictly needed, but can be nesessary if you want to run the ccm in an none default config where each controller gets its own SA.

  - apiGroups:
      - ""
    resources:
      - serviceaccounts
    verbs:
      - create

Fixes #1004

feat(helm): use custom ClusterRole

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.80%. Comparing base (f5345d1) to head (e295a72).
⚠️ Report is 10 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1042      +/-   ##
==========================================
- Coverage   67.52%   63.80%   -3.73%     
==========================================
  Files          23       23              
  Lines        3249     3249              
==========================================
- Hits         2194     2073     -121     
- Misses        885     1011     +126     
+ Partials      170      165       -5     

Flag	Coverage Δ
e2e	?
unit	63.80% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[lukasmetzner]

Hey @hegerdes, I have removed a few things, which are in the AWS CCM, but I don't see a reason to have them here.

Here are the officially required rules by the Kubernetes docs: https://kubernetes.io/docs/concepts/architecture/cloud-controller/#authorization-miscellaneous

In addition with the ConfigMaps, I don't see anything we would need otherwise.

[hegerdes]

Thx. Will test the suggestions again within the next days and update the PR.

You use the tools in scripts to generate the .snapshot files right?

[lukasmetzner]

Thx. Will test the suggestions again within the next days and update the PR.

You use the tools in scripts to generate the .snapshot files right?

Yes. We use scripts/update-helm-snapshots.sh and scripts/update-deployment-yamls.sh.

[hegerdes]

Everything updated. My own test with ccm in hcloud deployment succeeded