Don't give operator permissions to create CRDs if not needed

[lambdanis]

Tetragon Operator has an option to skip CRD creation, but even if it's used, the operator ClusterRole still contains permissions to create CRDs. For slightly better security hygiene, these permissions can be included conditionally, only if needed.

[itsCheithanya]

I would like to contribute to this issue, can you guide me on how to get started

[lambdanis]

@itsCheithanya Thanks! To implement the fix, you'll need to use the Helm if block in the operator ClusterRole. It should be a pretty small change.

To test it, first create a local kind cluster:

./contrib/localdev/bootstrap-kind-cluster.sh

then create a local values.yaml file with CRD creation disabled:

tetragonOperator:
  skipCRDCreation: true

and install Tetragon with using local Helm chart and your values.yaml file:

./contrib/localdev/install-tetragon.sh --values values.yaml

Then, check the operator ClusterRole using kubectl:

kubectl get clusterrole tetragon-operator -oyaml

I hope this gives you a starting point.