Restrict RBAC

[devstein]

In the current cluster-role-binding, the default ServiceAccount in the istio-system is given the cluster-admin role. Why is this necessary? What are the RBAC permissions required by the App Identity and Access Adapter?

[jpapejr]

Seems like it could be pared down to basic CRUD ops on the following api-resources:

jwtconfigs                                             security.cloud.ibm.com                true         JwtConfig
oidcconfigs                                            security.cloud.ibm.com                true         OidcConfig
policies                                               security.cloud.ibm.com                true         Policy