Add RBAC Guidelines

[agrimmer]

No description provided.

[jetzlstorfer]

Thanks for the PR!
Does that mean all existing keptn-sandbox projects would have to be updated once the RBAC rules are effective, e.g, with the next keptn release? Or is the access to API tokens (e.g., unleash or dynatrace) still working?

[agrimmer]

The currently used default ServiceAcount will still be available, however, with a limited set of rights. If you for example access the API token using the k8s-API, a dedicated RBAC rule is required.

[jetzlstorfer]

we need to clarify this sentence, e.g.,:
Let's imagine the Keptn service (which corresponds to a Kubernetes deployment and service) named keptn-sample-service requires read-access for a secret called keptn-sample-secret in the keptn namespace.

[agrimmer]

Thanks, addressed.

[jetzlstorfer]

We should also add the changes that are necessary if no additional permissions are needed.

It would be helpful to have two scenarios:
Scenario 1: no additional permissions required --> what to change
Scenario 2: permissions to read a secret required --> what to change

[jetzlstorfer]

lgtm