Feature/read permission (erda-project#2437)

* feat: change read permission to get, list and watch all resources

* fix: read api-server host and port from env

build/scripts/cluster-agent/shell-setup.sh

@@ -13,7 +13,7 @@ kind: Config
 clusters:
 - cluster:
     api-version: v1
-    server: "https://kubernetes:443"
+    server: "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}"
     insecure-skip-tls-verify: true
   name: "Default"
 contexts:

modules/cmp/steve/predefined_resource.go

@@ -207,6 +207,20 @@ rules:
   - 'pods/exec'
   verbs:
   - '*'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: erda-readonly
+rules:
+- apiGroups:
+  - "*"
+  resources:
+  - '*'
+  verbs:
+  - get
+  - list
+  - watch
 `
 	ClusterRoleBindingExpression = `
 ---
@@ -217,7 +231,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: view
+  name: erda-readonly
 subjects:
 - kind: Group
   name: erda-org-support