Fix default permissions to be able to read secrets cluster wide

[chrisdoherty4]

The default RBAC deployed with Rufio doesn't let it read secrets across namespaces. This is problematic as secrets containing BMC credentials are referenced by Machine resources and could reside in a different namespace.

Kubernetes doesn't currently offer a way to model access to secrets referenced from existing objects so its common practice to allow cluster wide reads and let consumers reconfigure the RBAC to their needs on deployment.

[pokearu]

Is the idea to have cluster wide Secret read as the default RBAC or can we instead have the default manifest that Rufio generates to have everything namespaced?
This allows the users to modify the manifest to how they want their cluster permissions to looks like.

[chrisdoherty4]

I'm proposing cluster wide read access by default to enable a functional out of the box Rufio.

Trying to restrict to a subset of namespaces requires knowing what those namespaces are which isn't possible (for codification purposes) as the operator defines them. This approach is adopted by several open source projects already because Kubernetes doesn't offer a way to model transitive access.

I've been told transitive access is in the works upstream in Kubernetes and will allow operators to define I can read B if B is referenced by A and I have read access to A semantics which is really what we want.

[pokearu]

I am fine with having cluster wide read on Secrets by default 👍 I see we do that on CAPT at the moment as well.
I believe that's how we had it originally but we wanted to make it namespaced, as discussed here.
Will update my PR to give cluster wide reads for now.

[chrisdoherty4]

Fixed in #63