Remove unnecessary pods RBAC permissions

The workload rbacRules and kubebuilder RBAC markers granted the operator and
its workload service account full CRUD (create/delete/get/list/patch/update/
watch) on core Pods, but the operator never reads or writes Pod objects
directly — pods only ever come into being indirectly via Deployments/
StatefulSets/Jobs. Remove the unused pods permission and regenerate
config/rbac/role.yaml.

Signed-off-by: Martin Schuppert <mschuppert@redhat.com>

Author: stuggi

config/rbac/role.yaml

@@ -8,7 +8,6 @@ rules:
   - ""
   resources:
   - configmaps
-  - pods
   - secrets
   - services
   verbs:

internal/controller/keystoneapi_controller.go

@@ -125,7 +125,6 @@ type KeystoneAPIReconciler struct {
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
 // keystone service account permissions that are needed to grant permission to the above
 // +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
-// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
 
 // Reconcile reconcile keystone API requests
 func (r *KeystoneAPIReconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ctrl.Result, _err error) {
@@ -549,11 +548,6 @@ func (r *KeystoneAPIReconciler) reconcileInit(
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},
-		{
-			APIGroups: []string{""},
-			Resources: []string{"pods"},
-			Verbs:     []string{"create", "get", "list", "watch", "update", "patch", "delete"},
-		},
 	}
 	rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
 	if err != nil {