Move starting/stopping impersonation proxy server to a new controller

- Watch a configmap to read the configuration of the impersonation
  proxy and reconcile it.
- Implements "auto" mode by querying the API for control plane nodes.
- WIP: does not create a load balancer or proper TLS certificates yet.
  Those will come in future commits.

Signed-off-by: Margo Crawford <margaretc@vmware.com>

deploy/concierge/rbac.yaml

@@ -31,9 +31,12 @@ rules:
     resources: [ securitycontextconstraints ]
     verbs: [ use ]
     resourceNames: [ nonroot ]
-  - apiGroups: [""]
-    resources: ["users", "groups"]
-    verbs: ["impersonate"]
+  - apiGroups: [ "" ]
+    resources: [ "users", "groups" ]
+    verbs: [ "impersonate" ]
+  - apiGroups: [ "" ]
+    resources: [ nodes ]
+    verbs: [ list ]
   - apiGroups:
       - #@ pinnipedDevAPIGroupWithPrefix("config.concierge")
     resources: [ credentialissuers ]
@@ -84,9 +87,12 @@ rules:
   - apiGroups: [ "" ]
     resources: [ pods/exec ]
     verbs: [ create ]
-  - apiGroups: [apps]
-    resources: [replicasets,deployments]
-    verbs: [get]
+  - apiGroups: [ apps ]
+    resources: [ replicasets,deployments ]
+    verbs: [ get ]
+  - apiGroups: [ "" ]
+    resources: [ configmaps ]
+    verbs: [ list, get, watch ]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1