RBAC management

[jkupferer]

It is difficult to track what ClusterRoleBindings and RoleBindings grant access to users and groups. It would be useful to support a mechanism of managing access that can both grant and revoke access to users, groups, and service accounts.

  cluster_role_bindings:
    cluster-admin:
      users: ['bob']
      groups: ['my-cluster-admins']
      service_accounts:
      - name: automation
        namespace: default      
      remove_unlisted: ['users', 'groups']