Allow running with operator role

[otrosien]

Hi,

I have a deployment where I'm using the operator role for my kubernetes namespace, so I have full access, but only within my own namespace. chaoskube becomes ready but fails to operate.

pods is forbidden: User \\\"system:serviceaccount:poirot-test:operator\\\" cannot list pods at the cluster scope: unauthorized access system:serviceaccount:xxxxxxxx:operator/[system:serviceaccounts system:serviceaccounts:xxxxxxxx system:authenticated]

[otrosien]

... readiness probe should probably fail if things like this happen.

[linki]

Perfect idea. I'll put this on my roadmap.

[linki]

I didn't have RBAC in mind. Given the current implementation it always needs pod-reader access on a global scope. Which means limiting chaoskube to one or more namespaces doesn't allow you to also restrict its access to only those namespaces. This would be desireable as well.

[bavarianbidi]

@otrosien please have a look at this PR: #91

could you paste the used role and rolebinding?

[linki]

Created a dedicated issue for the readiness probe: #132

Avoiding global permissions is tracked here: #92