Make RBAC resources opt-in for the runtime-nodejs base

runtime-nodejs/kustomize-with-rbac/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+bases:
+- ../rbac-readonly
+- ../kustomize
+patchesStrategicMerge:
+- specs-serviceaccount.yaml

runtime-nodejs/kustomize-with-rbac/specs-serviceaccount.yaml

@@ -0,0 +1,8 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: specs
+spec:
+  template:
+    spec:
+      serviceAccountName: assert

runtime-nodejs/kustomize/kustomization.yaml

@@ -1,7 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-bases:
-- ../rbac-readonly
 resources:
 - scrapeable-deployment.yaml
 # TODO if many tests reuse this base, how do we manage podmonitor?

runtime-nodejs/kustomize/scrapeable-deployment.yaml

@@ -12,7 +12,6 @@ spec:
       labels:
         kubernetes-assert: metrics
     spec:
-      serviceAccountName: assert
       containers:
       - name: specs
         # We can't have a tag here because https://kubectl.docs.kubernetes.io/pages/reference/kustomize.html#images won't unset it, and Skaffold required no-tag URLs for build