chore(rbac): Adding minimal rbac permissions with comments description (#513)

* chore(rbac): Adding minimal rbac permissions with comments description

Signed-off-by: shubham chaudhary <shubham@chaosnative.com>

* chore(chart): Adding minimal rbac permissions in charts

Signed-off-by: shubham chaudhary <shubham@chaosnative.com>

charts/generic/pod-dns-error/rbac-psp.yaml

@@ -17,28 +17,51 @@ metadata:
     name: pod-dns-error-sa
     app.kubernetes.io/part-of: litmus
 rules:
+   # Create and monitor the experiment & helper pods
   - apiGroups: [""]
-    resources: ["pods", "events"]
-    verbs:
-      ["create", "list", "get", "patch", "update", "delete", "deletecollection"]
+    resources: ["pods"]
+    verbs: ["create","delete","get","list","patch","update", "deletecollection"]
+  # Performs CRUD operations on the events inside chaosengine and chaosresult
   - apiGroups: [""]
-    resources: ["pods/exec", "pods/log", "replicationcontrollers"]
-    verbs: ["create", "list", "get"]
-  - apiGroups: ["batch"]
-    resources: ["jobs"]
-    verbs: ["create", "list", "get", "delete", "deletecollection"]
+    resources: ["events"]
+    verbs: ["create","get","list","patch","update"]
+  # Fetch configmaps details and mount it to the experiment pod (if specified)
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get","list",]
+  # Track and get the runner, experiment, and helper pods log 
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get","list","watch"]  
+  # for creating and managing to execute comands inside target container
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["get","list","create"]
+  # deriving the parent/owner details of the pod(if parent is anyof {deployment, statefulset, daemonsets})
   - apiGroups: ["apps"]
-    resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
-    verbs: ["list", "get"]
+    resources: ["deployments","statefulsets","replicasets", "daemonsets"]
+    verbs: ["list","get"]
+  # deriving the parent/owner details of the pod(if parent is deploymentConfig)  
   - apiGroups: ["apps.openshift.io"]
     resources: ["deploymentconfigs"]
-    verbs: ["list", "get"]
+    verbs: ["list","get"]
+  # deriving the parent/owner details of the pod(if parent is deploymentConfig)
+  - apiGroups: [""]
+    resources: ["replicationcontrollers"]
+    verbs: ["get","list"]
+  # deriving the parent/owner details of the pod(if parent is argo-rollouts)
   - apiGroups: ["argoproj.io"]
     resources: ["rollouts"]
-    verbs: ["list", "get"]
+    verbs: ["list","get"]
+  # for configuring and monitor the experiment job by the chaos-runner pod
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create","list","get","delete","deletecollection"]
+  # for creation, status polling and deletion of litmus chaos resources used within a chaos workflow
   - apiGroups: ["litmuschaos.io"]
-    resources: ["chaosengines", "chaosexperiments", "chaosresults"]
-    verbs: ["create", "list", "get", "patch", "update"]
+    resources: ["chaosengines","chaosexperiments","chaosresults"]
+    verbs: ["create","list","get","patch","update","delete"]
+  # use litmus psp
   - apiGroups: ["policy"]
     resources: ["podsecuritypolicies"]
     verbs: ["use"]