fix: Always create the operator ClusterRoleBinding (#637)

serviceAccount.create gated both the ServiceAccount and the ClusterRoleBinding,
so with create=false the chart rendered the ClusterRole but nothing bound it. The
operator then ran as the ServiceAccount the user supplied, with none of the
permissions it needs, and nothing said so.

The binding now renders unconditionally, like the ClusterRole in roles.yaml
already does. serviceAccount.create=false means "I supply the ServiceAccount",
and the chart still wires it to the operator ClusterRole.

This is a regression, not the original design. zookeeper-operator#247 (0265e72,
2021-11-11) had the ServiceAccount, the ClusterRole and the ClusterRoleBinding
all inside the same gate, so create=false coherently meant "I provide the RBAC".
operator-templating#7 (2ce5e08, 2021-11-24) split the ClusterRole out into
roles.yaml.j2 without a gate and left the binding behind in one.

Also corrects the comment above the binding, which was kubebuilder scaffold text
about reading secrets in any namespace. The same commit carried other scaffold
leftovers, such as rules granting pods and configmaps under a comment about
accessing Secret objects.

No object changes in the default render. The corrected comment does change it,
because template comments end up in the rendered manifest.

Reported by @dervoeti on listener-operator#418.

Author: lfrancke

template/deploy/helm/[[operator]]/templates/serviceaccount.yaml.j2

@@ -10,9 +10,11 @@ metadata:
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
+{{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-# This cluster role binding allows anyone in the "manager" group to read secrets in any namespace.
+# Grants the operator ServiceAccount the ClusterRole from roles.yaml, which is what lets the
+# operator watch and manage its custom resources across the cluster.
 kind: ClusterRoleBinding
 metadata:
   name: {{ include "operator.fullname" . }}-clusterrolebinding
@@ -26,4 +28,3 @@ roleRef:
   kind: ClusterRole
   name: {{ include "operator.fullname" . }}-clusterrole
   apiGroup: rbac.authorization.k8s.io
-{{- end }}