RBAC roles and bindings installed by ./hack/prepare-e2e.sh masks errors and missing configuration in the helm RBAC template

[wallrj]

Can we remove any of that stuff from prepare-e2e.sh and move it into the chart?

And I think we need to figure out how to force kubectl to connect to the apiserver as an authenticated user.

/kind bug

[munnerz]

I think we could probably move this into the chart:

# Create a ClusterRole to work with ElasticsearchCluster resources
- apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: ClusterRole
  metadata:
    name: navigator:authenticated
  # this rule defined on the role for specifically the
  # namespace-lifecycle admission-controller
  rules:
  - apiGroups: ["navigator.jetstack.io"]
    resources: ["elasticsearchclusters", "pilots"]
    verbs:     ["get", "list", "watch", "create", "update", "delete"]
- apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: ClusterRoleBinding
  metadata:
    name: "navigator:authenticated"
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: navigator:authenticated
  subjects:
  - kind: Group
    name: system:authenticated
    apiGroup: rbac.authorization.k8s.io
  - kind: Group
    name: system:unauthenticated
    apiGroup: rbac.authorization.k8s.io

but not the other bits.

afaik kubectl is connecting as an authenticated user - I think the error message just masks what the actual username is or something. Otherwise more requests than just the ones we see failing would be failing (plus also, minikube configures kubectl to talk to the apiserver on port 8443, which is a secure port which requires auth)

[munnerz]

Closed by #122