Add SA to each namespace for running cron jobs

This PR supports adding a UI for https://konflux-ci.dev/docs/testing/integration/periodic-integration-tests/
In order for the UI to work an SA with correct permissions to mutate snapshots must exist in the namespace with a predictable name.
Signed-off-by: Brian Cook <[email protected]>

Author: brianwcook

components/konflux-rbac/base/konflux-cron-sa-actions.yaml

@@ -0,0 +1,17 @@
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: konflux-cron-sa-actions
+  labels:
+    konflux-cluster-role: "true"
+rules:
+  - verbs:
+      - get
+      - list
+      - watch
+      - patch
+    apiGroups:
+      - appstudio.redhat.com
+    resources:
+      - snapshots 

components/konflux-rbac/base/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
 - appstudio-pipelines-runner.yaml
 - konflux-integration-runner.yaml
+- konflux-cron-sa-actions.yaml

components/policies/staging/base/konflux-rbac/bootstrap-tenant-namespace/bootstrap-tenant-namespace-np-konflux-cron-sa.yaml

@@ -0,0 +1,46 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: init-ns-cron-sa
+spec:
+  generateExisting: true
+  rules:
+    - name: generate-serviceaccount
+      match:
+        any:
+        - resources:
+            kinds:
+            - Namespace
+            selector:
+              matchLabels:
+                konflux-ci.dev/type: tenant
+      generate:
+        kind: ServiceAccount
+        apiVersion: v1
+        name: konflux-cron-sa
+        namespace: '{{request.object.metadata.name}}'
+        synchronize: true
+    - name: generate-snapshot-rolebinding
+      match:
+        any:
+        - resources:
+            kinds:
+            - Namespace
+            selector:
+              matchLabels:
+                konflux-ci.dev/type: tenant
+      generate:
+        kind: RoleBinding
+        apiVersion: rbac.authorization.k8s.io/v1
+        name: snapshot-access-binding
+        namespace: '{{request.object.metadata.name}}'
+        synchronize: true
+        data:
+          roleRef:
+            kind: ClusterRole
+            name: konflux-cron-sa-actions
+            apiGroup: rbac.authorization.k8s.io
+          subjects:
+            - kind: ServiceAccount
+              name: konflux-cron-sa
+              namespace: '{{request.object.metadata.name}}'