chore: Split the roles.yaml into separate files for clusterrole-operator.yaml and clusterrole-product.yaml

Also rename the opa-builder clusterrole file to be consistent

Author: NickLarsenNZ

…perator/templates/roles-opa-builder.yaml …r/templates/clusterrole-opa-builder.yamldeploy/helm/opa-operator/templates/roles-opa-builder.yaml renamed to deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml deploy/helm/opa-operator/templates/roles-opa-builder.yaml renamed to deploy/helm/opa-operator/templates/clusterrole-opa-builder.yaml

@@ -112,23 +112,3 @@ rules:
       - {{ include "operator.name" . }}clusters/status
     verbs:
       - patch
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "operator.name" . }}-clusterrole
-  labels:
-  {{- include "operator.labels" . | nindent 4 }}
-rules:
-{{ if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
-  # Required on OpenShift to allow the OPA pods to run as a non-root user.
-  - apiGroups:
-      - security.openshift.io
-    resources:
-      - securitycontextconstraints
-    resourceNames:
-      - nonroot-v2
-    verbs:
-      - use
-{{ end }}

…y/helm/opa-operator/templates/roles.yaml …ator/templates/clusterrole-operator.yamldeploy/helm/opa-operator/templates/roles.yaml renamed to deploy/helm/opa-operator/templates/clusterrole-operator.yaml deploy/helm/opa-operator/templates/roles.yaml renamed to deploy/helm/opa-operator/templates/clusterrole-operator.yaml

@@ -0,0 +1,21 @@
+---
+# Product ClusterRole: bound (via per OpaCluster RoleBinding) to the ServiceAccount that OPA
+# workload pods run as.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "operator.name" . }}-clusterrole
+  labels:
+  {{- include "operator.labels" . | nindent 4 }}
+rules:
+{{ if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
+  # Required on OpenShift to allow the OPA pods to run as a non-root user.
+  - apiGroups:
+      - security.openshift.io
+    resources:
+      - securitycontextconstraints
+    resourceNames:
+      - nonroot-v2
+    verbs:
+      - use
+{{ end }}