chore: Describe RBAC rules, remove unnecessary rules

[NickLarsenNZ]

Part of stackabletech/issues#798

Note

This was initially generated by a coding assistant to see how well it can inspect code and review the RBAC rules. the changes will be properly checked before reviews are requested.

• Document each rule
• Check the docs make sense. Rewrite where necessary
• Remove unnecessary permissions
• Attach explanations to PR description
• Run all tests
• Split operator and product roles into separate files

Operator ClusterRole ({fullname}-clusterrole)

Rules removed entirely

Resource	Verbs removed	Reason
nodes	list, watch	Boilerplate from operator-templating (4 years old). KubernetesClusterInfo only uses nodes/proxy: get for cluster domain detection — no node listing or watching anywhere in the controller
endpoints	create, delete, get, list, patch, update, watch	Auto-created by Kubernetes for Services; the operator never manages endpoints directly
pods	create, delete, get, list, patch, update, watch	StatefulSets create pods; the operator never manages pods directly in the operator role

update verb removed from all rules

SSA (apply_patch) uses HTTP PATCH, not HTTP PUT. client.update() is never called anywhere in the operator source.

watch removed from resources not watched by the controller

Resource	Reason
serviceaccounts	Applied via cluster_resources.add() + orphan cleanup, but not watched via .owns() or .watches() in main.rs
rolebindings	Same as above
batch/jobs	Same as above
poddisruptionbudgets	Same as above
listeners.stackable.tech/listeners	Same as above — watch was added when the listener operator was integrated but no .owns(Listener) or .watches(Listener) call exists

secrets reduced to get, create

The operator only calls client.get_opt::<Secret>() (to check existence) and client.create() (to generate the sensitive-property key and OIDC admin password). Secrets are never tracked by cluster_resources, so list, delete, patch, update, and watch are all unnecessary.

patch removed from nificlusters

The operator only calls apply_patch_status() on NifiCluster objects, which targets the /status subresource (covered by the separate nificlusters/status: patch rule). The main resource is never patched directly.

---

Product ClusterRole ({name}-clusterrole)

No changes. Product-side permissions (NiFi's own runtime needs for Kubernetes-native clustering and ConfigMap cluster state) cannot be verified from the operator's Rust source and were left as-is.