More restrict permissions

[guettli]

User Story

As an operator I would like to have the operator have less RBAC permissions, so that a bug in the operator can't accidentally do bad things.

Detailed Description

The role.yaml looks like this at the moment:

https://github.com/kubernetes-sigs/cluster-api-operator/blob/main/config/rbac/role.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: manager-role
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'

At the moment manager-role can do everything. Is this needed?

/kind feature

[k8s-ci-robot]

This issue is currently awaiting triage.

If CAPI Operator contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.