overly broad permissions: leases permissions should be namespace scoped

[nairb774]

/kind bug

What happened?

The current deployment creates a ClusterRole/ClusterRoleBinding with the leases permission.

What you expected to happen?

The deployment uses the minimal set of permissions necessary. This set of permissions should be able to be moved to a Role/RoleBinding in the namespace where the driver is deployed. As best I can tell, the code only needs to create/use a lease in the containing namespace and not in all namespaces cluster wide.

How to reproduce it (as minimally and precisely as possible)?

Follow the install instructions for either a kustomize or helm install.

Anything else we need to know?:

aws-ebs-csi-driver/deploy/kubernetes/base/clusterrole-provisioner.yaml

Lines 34 to 36 in cbd4697

	- apiGroups: [ "coordination.k8s.io" ]
	resources: [ "leases" ]
	verbs: [ "get", "watch", "list", "delete", "update", "create" ]

aws-ebs-csi-driver/charts/aws-ebs-csi-driver/templates/clusterrole-provisioner.yaml

Lines 33 to 35 in cbd4697

	- apiGroups: [ "coordination.k8s.io" ]
	resources: [ "leases" ]
	verbs: [ "get", "watch", "list", "delete", "update", "create" ]

Environment

• Kubernetes version (use kubectl version): 1.22
• Driver version: v1.17.0