generate agent-observability role rules in vault instead of static RBAC

config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml

@@ -1,4 +1,6 @@
 allowed_kubernetes_namespaces:
   - "vm-system"
-service_account_name: "agent-observability"
+  - "observability"
+  - "logging"
+kubernetes_role_type: "Role"
 extra_labels: {}

resources/secret_backend/kubernetes/au/syd1/roles/agent-observability.yaml

@@ -0,0 +1,62 @@
+---
+rules:
+  # Verbs are listed explicitly rather than "*": delete on a VLCluster reclaims
+  # its cephrbd-fast-delete PVCs, destroying the log store.
+  - apiGroups:
+      - "operator.victoriametrics.com"
+    resources:
+      - "*"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+      - "create"
+      - "patch"
+      - "update"
+  - apiGroups:
+      - "apps"
+    resources:
+      - "deployments"
+      - "statefulsets"
+      - "daemonsets"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+      - "patch"
+      - "update"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+      - "delete"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods/log"
+    verbs:
+      - "get"
+  - apiGroups:
+      - ""
+    resources:
+      - "services"
+      - "configmaps"
+      - "endpoints"
+      - "events"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+  - apiGroups:
+      - "gateway.networking.k8s.io"
+    resources:
+      - "gateways"
+      - "httproutes"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"