add aggregated ClusterRole to manage namespaced resources

[eumel8]

fixes #1398

[pepov]

Thanks for the proposal and for the implementation! However I would like to separate these clusterroles based on the following resources:

• host tailer
• flows & outputs + syslogngflows & outputs
• clusterflows & outputs + syslogngclusterflows & outputs

I'm not sure about the eventtailer, since that is something to be installed once into a logging system, not something to manage by individual users.

Also I would create a viewer role, that doesn't have to be split by resources, just grant view privileges to all the above logging resources for users.

I'm still a bit sceptical that we can provide clusterroles that are useful for most users/use cases, but at least we can provide an example implementation.

[eumel8]

@pepov Rancher has this implementation also for read-only/view access.
Aggregation is a common RBAC feature in Kubernetes and useful not only in context with Rancher projects. An extra value flag under the rbac section of the chart is also possible. At the moment normal user haven't access to Flow and Output resources.

[pepov]

I would either name the clusterrole as "-edit" and add aggregator label for editor as well as in these examples:

• https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles
• https://github.com/cert-manager/cert-manager/blob/cabc05824abbf033440b56d25c914701610d528f/deploy/charts/cert-manager/templates/rbac.yaml#L432

Or if we want to follow the rancher example then use the suffix '-admin' instead of user.