The cluster-admin will define the required policy rules in a cluster role and provide the cluster role name as an environment variable in the operator Subscription resource. The operator will read these variables and create the role binding for the Argo CD application controller and server components. These roles will be used by all the instances across the cluster and could be further improved in the future to restrict them to a single instance. In the absence of these variables, the operator will use the default admin roles.

Acceptance Criteria

• Create a new env var in the operator which is used to restrict permission namespaced scope argocd instances globally
• The environment variable is optional.  If it is set, the role binding should bind the cluster role of the namespace scope instance SA
• Unit/e2e tests upstream and downstream
• Update doc