Add checks for annotation to opt out of cluster owner RBAC

[JonCrowther]

Issue: rancher/rancher#45591

Requires rancher/rancher changes: rancher/rancher#47259

Problem

When a service account creates a cluster, the project handler and cluster handler both attempt to create ClusterOwner and ProjectOwner roles and bind those roles to the service account. The problem is that we don't support those roles for service accounts, so the logs get flooded with errors as it keeps retrying to add those roles.

Solution

To avoid the errors and the re-queuing, we have added a new annotation field.cattle.io/no-creator-rbac. When it is set the webhook does not set the field.cattle.io/creatorId annotation to clusters because the controllers will no longer be creating RBAC for the creator of the cluster.

I moved some annotations to the common package as I felt it was more apt. I also cleaned up some functions in the common package to make them more consistent.

CheckList

• Test
• Docs

[pmatseykanets]

I think we need to add checks for creatorId in the presence of no-creator-rbac in cluster and project validators. Unfortunately the common. CheckCreatorID() can't be used in those cases as it also checks if the creatorId matches request.UserInfo.Username which is not going to work (for projects for sure).

[JonCrowther]

I think we need to add checks for creatorId in the presence of no-creator-rbac in cluster and project validators. Unfortunately the common. CheckCreatorID() can't be used in those cases as it also checks if the creatorId matches request.UserInfo.Username which is not going to work (for projects for sure).

I've added a new function to common to check that only one of creatorId and no-creator-rbac is set for use by project and cluster validators.