prow: use container.deployer role for deployer SA

[spiffxp]

prow-deployer was using roles/container.developer which is insufficient to automatically deploy resources related to RBAC and webhooks, so we've created a custom role to allow full control of all in-cluster resources without granting access to control the cluster itself

This is followup to #2156 which created the role

And #2148 (comment) which is where we discovered the insufficiency of roles/container.developer for auto-deploying kubernetes-external-secrets

[spiffxp]

/cc @BenTheElder @ameukam
I dropped the manual binding

gcloud projects remove-iam-policy-binding \
  k8s-infra-prow-build-trusted \
  --member="serviceAccount:prow-deployer@k8s-infra-prow-build-trusted.iam.gserviceaccount.com" \
  --role="roles/container.admin"

And have already run terraform apply for these changes

[BenTheElder]

lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: BenTheElder, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• infra/gcp/clusters/projects/k8s-infra-prow-build-trusted/OWNERS [BenTheElder,spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ameukam]

/lgtm

[spiffxp]

Failed to auto-deploy kubernetes-external-secrets again: #2194 (comment)

Specific failure:

clusterroles.rbac.authorization.k8s.io "kubernetes-external-secrets" is forbidden: user "prow-deployer@k8s-infra-prow-build-trusted.iam.gserviceaccount.com" (groups=["system:authenticated"]) is attempting to grant RBAC permissions not currently held:
{APIGroups:[""], Resources:["namespaces"], Verbs:["get" "watch" "list"]}
{APIGroups:[""], Resources:["secrets"], Verbs:["create" "update"]}
{APIGroups:["apiextensions.k8s.io"], Resources:["customresourcedefinitions"], ResourceNames:["externalsecrets.kubernetes-client.io"], Verbs:["get" "update"]}
{APIGroups:["kubernetes-client.io"], Resources:["externalsecrets"], Verbs:["get" "watch" "list"]}
{APIGroups:["kubernetes-client.io"], Resources:["externalsecrets/status"], Verbs:["get" "update"]}

I'm guessing the reason this worked when prow-deployer had roles/container.admin is that something implicitly grants that GCP role a K8S role permitting update of K8S resources. I'm going to take a closer look at how prow is configured to talk to its build clusters.

[spiffxp]

tracking issue ref: #2218