RBAC Rules for trusted prowjobs

[simplyzee]

We have different workloads that run in different clusters e.g. trusted. This YAML snippet applies the required roles to ensure the services that talk from other clusters can read, update and delete CI jobs that have run in the other clusters.

I've attached it here for now since we don't have a place to store or run apply these changes to another cluster. This YAML snippet has already been applied to -trusted and the -gke cluster

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: test-pods
  name: "sinker"
rules:
  - apiGroups:
    - ""
    resources:
    - pods
    verbs:
    - list
    - watch
    - patch
    - get
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: test-pods
  name: "sinker"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: "sinker"
subjects:
- kind: User
  name: "client"
  apiGroup: rbac.authorization.k8s.io

[irbekrm]

Similarly I have also hand-created a service account for Config Merger in the trusted cluster (cc @wallrj )

apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    iam.gke.io/gcp-service-account: testgrid-updater@jetstack-build-infra-internal.iam.gserviceaccount.com
  labels:
    app.kubernetes.io/part-of: prow
  namespace: test-pods
  name: testgrid-updater