RBAC: enforce standard k8s RBAC policy

This PS removes the lax RBAC policy used in OSH to date, and the
standard rules are applied.

Change-Id: Ic2cf6063a4c0b7c4a6e73094f55ad424effc965c

tools/gate/playbooks/deploy-helm-packages/tasks/main.yaml

@@ -10,8 +10,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- include: helm-setup-dev-environment.yaml
-
 - include: generate-dynamic-over-rides.yaml
 
 - name: "iterating through Helm chart groups"

tools/gate/playbooks/deploy-helm-packages/tasks/util-setup-dev-environment.yaml

@@ -1,31 +0,0 @@
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-- name: disable rbac
-  block:
-    - name: rbac | moving manifests into place
-      template:
-        src: "{{ item }}.j2"
-        dest: "/tmp/{{ item }}"
-        mode: 0666
-      with_items:
-        - clusterrolebinding.yaml
-    - name: rbac | creating objects
-      command: "kubectl replace -f /tmp/{{ item }}"
-      with_items:
-        - clusterrolebinding.yaml
-    - name: rbac | removing manifests
-      file:
-        path: "/tmp/{{ item }}"
-        state: absent
-      with_items:
-        - clusterrolebinding.yaml

tools/gate/playbooks/deploy-helm-packages/templates/clusterrolebinding.yaml.j2

@@ -1,18 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: cluster-admin
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-- apiGroup: rbac.authorization.k8s.io
-  kind: Group
-  name: system:masters
-- apiGroup: rbac.authorization.k8s.io
-  kind: Group
-  name: system:authenticated
-- apiGroup: rbac.authorization.k8s.io
-  kind: Group
-  name: system:unauthenticated