Velero: Consider broadening ark service account permissions to cluster admin

[ncdc]

The service account we use is currently allowed to list/watch/create all resources in all namespaces. While this is sufficient for all backup operations, it is only partially so for restore operations.

While most restore operations will succeed, attempting to restore roles and/or clusterroles that have greater privileges than the ark service account fail.

We might want to broaden the privileges to cluster-admin. WDYT @mattmoyer @jbeda @skriss?

[ncdc]

xref #23

[jrnt30]

Would this be necessary if #18 were addressed? As I understood that, the goal was to have Ark simply impersonate the credentials of the given user.

In the short term I do think that it would be more straightforward to increase the scope of to ClusterAdmin so that the tool works as the user would expect. One of the unfortunate things about the current model would be that an operator would not know it wasn't working properly until they were trying to test the restore process itself and a few of theses services may not be immediately apparent that they were not restored properly.

[ncdc]

I think as part of #18 we will need to revisit this, but for now, it's a short-term win.