[epic] Permission validation preflight stage 2

[trgeiger]

After stage 1 of the permissions validation preflight epic is complete, the next stage will be to add API fields that hold structured permissions data.

There are more details in the phase 1 RFC.

References:

1: https://github.com/carvel-dev/kapp/tree/develop/pkg/kapp/permissions

Brief: https://docs.google.com/document/d/1fCkUaaXebfF1237iRrFC-F7HNNe7-TFeXpN0wSUdiXc/edit?usp=sharing
RFC: https://docs.google.com/document/d/1W7ThVE7yAd43IW1KETAB9x8pQqIRu7Dqs7jZi5QjQaM/edit?usp=sharing

sub-issues:

• Decouple Pre-Authorizer from Component-Specific Permission Requirements #1911

[trgeiger]

The future of this epic is unclear now. We might eventually build on the permissions preflight work to make it easier for users to derive the least privileged set of RBAC needed for an operator, but if that happens it's likely not going to be through an API field as described above and it's not going to involve carvel.

We are planning on introducing the ability to use impersonation/synthetic permissions for ClusterExtension installation and management, rather than using real service accounts, and much of that work has implications for any future development of the permissions preflight.

So in summary, the idea to improve the UX for managing permissions is still a good idea, but we are pursuing that goal in other work related to impersonation and Boxcutter, so this particular issue is no longer relevant.