Restrict konnector clusterrole and dynamically provision RBAC per binding

[alokkumardalei-wq]

Fixes #303

What changed?

This PR removes the cluster-admin wildcard (*) access from the kube-bind-konnectorand introduces a dynamic RBAC generation model.

Previously, the konnector required apiGroups: "*" to sync arbitrary custom resources (e.g. mangodbs.foo.bar). Now:

• Base Permissions Restricted: The konnector's static ClusterRole (in both the CLI and Backend manifests) is strictly scoped to the absolute minimum it needs to function (core infrastructure, kube-bind CRDs, leases, etc.).
• Dynamic RBAC Generation: When a consumer executes kubectl bind, the CLI intercepts the APIServiceExportRequest and dynamically generates a highly specific ClusterRole granting access only to the exact API Groups and Resources being bound.
• Automatic Cleanup: The dynamic RBAC objects are tied to the APIServiceBinding using OwnerReferences. Deleting the binding automatically revokes the konnector's permissions.

Testing & Validation

• Compiled successfully: make build completes with no errors.

alokkumardalei@Aloks-MacBook-Air kbind % make build
hack/verify-go-versions.sh
Verifying minimum Go version: 1.26.2
Verifying build Go version: 1.26.2
+ cd ./cmd/
+ go build '-ldflags=-X k8s.io/client-go/pkg/version.gitCommit=d7f16bc -X k8s.io/client-go/pkg/version.gitTreeState=clean -X k8s.io/client-go/pkg/version.gitVersion=v1.36.0+kube-bind-v0.0.0-d7f16bc -X k8s.io/client-go/pkg/version.gitMajor=1 -X k8s.io/client-go/pkg/version.gitMinor=36 -X k8s.io/client-go/pkg/version.buildDate=2026-07-17T15:02:08Z -X k8s.io/component-base/version.gitCommit=d7f16bc -X k8s.io/component-base/version.gitTreeState=clean -X k8s.io/component-base/version.gitVersion=v1.36.0+kube-bind-v0.0.0-d7f16bc -X k8s.io/component-base/version.gitMajor=1 -X k8s.io/component-base/version.gitMinor=36 -X k8s.io/component-base/version.buildDate=2026-07-17T15:02:08Z' -o /Users/alokkumardalei/Desktop/kbind/kbind/bin/ ./...
+ cd ./cli/cmd/
+ go build '-ldflags=-X k8s.io/client-go/pkg/version.gitCommit=d7f16bc -X k8s.io/client-go/pkg/version.gitTreeState=clean -X k8s.io/client-go/pkg/version.gitVersion=v1.36.0+kube-bind-v0.0.0-d7f16bc -X k8s.io/client-go/pkg/version.gitMajor=1 -X k8s.io/client-go/pkg/version.gitMinor=36 -X k8s.io/client-go/pkg/version.buildDate=2026-07-17T15:02:08Z -X k8s.io/component-base/version.gitCommit=d7f16bc -X k8s.io/component-base/version.gitTreeState=clean -X k8s.io/component-base/version.gitVersion=v1.36.0+kube-bind-v0.0.0-d7f16bc -X k8s.io/component-base/version.gitMajor=1 -X k8s.io/component-base/version.gitMinor=36 -X k8s.io/component-base/version.buildDate=2026-07-17T15:02:08Z' -o /Users/alokkumardalei/Desktop/kbind/kbind/bin/ ./...
+ cd ./contrib/kcp/cmd/kcp-init/
+ go build '-ldflags=-X k8s.io/client-go/pkg/version.gitCommit=d7f16bc -X k8s.io/client-go/pkg/version.gitTreeState=clean -X k8s.io/client-go/pkg/version.gitVersion=v1.36.0+kube-bind-v0.0.0-d7f16bc -X k8s.io/client-go/pkg/version.gitMajor=1 -X k8s.io/client-go/pkg/version.gitMinor=36 -X k8s.io/client-go/pkg/version.buildDate=2026-07-17T15:02:08Z -X k8s.io/component-base/version.gitCommit=d7f16bc -X k8s.io/component-base/version.gitTreeState=clean -X k8s.io/component-base/version.gitVersion=v1.36.0+kube-bind-v0.0.0-d7f16bc -X k8s.io/component-base/version.gitMajor=1 -X k8s.io/component-base/version.gitMinor=36 -X k8s.io/component-base/version.buildDate=2026-07-17T15:02:08Z' -o /Users/alokkumardalei/Desktop/kbind/kbind/bin/ ./...

• Static Permissions Audit: Verified the base ClusterRole in cli/pkg/kubectl/bind-apiservice/plugin/deploy_konnector.go and backend/kubernetes/resources/konnector.go now explicitly whitelists "", kube-bind.io, apiextensions.k8s.io, and coordination.k8s.io rather than using wildcards.
• Dynamic Generation: Verified that cli/pkg/kubectl/bind-apiservice/plugin/rbac.go correctly iterates over request.Spec.Resources and request.Spec.PermissionClaims to construct the RBAC policy when a binding is created.