fix(dashboard): restrict RBAC to cluster-scoped resources and cleanup naming

Remove namespace-scoped resources (tenantsecrets, tenantnamespaces,
tenantmodules, virtualmachineinstances, virtualmachineinstances/vnc) from
the cozystack-dashboard-readonly ClusterRole bound to system:authenticated.
These resources must be accessed via per-namespace RoleBindings created by
the tenant operator, not through a cluster-wide grant to all authenticated
users.

Only truly cluster-scoped, public-by-design resources remain in the
ClusterRole: applicationdefinitions, storageclasses, backupclasses,
and dashboard.cozystack.io customization resources.

Also rename the leftover incloud-web-web-user-edit ClusterRoleBinding to
cozystack-dashboard-cluster-admin to match the new naming convention, and
declare Makefile targets as .PHONY.

Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>

packages/system/dashboard/Makefile

@@ -4,6 +4,8 @@ export NAMESPACE=cozy-$(NAME)
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
+.PHONY: image image-console image-token-proxy
+
 image: image-console image-token-proxy
 
 CONSOLE_REPO ?= https://github.com/cozystack/cozystack-ui.git

packages/system/dashboard/templates/clusterrolebinding-web-user-edit.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   annotations: {}
-  name: incloud-web-web-user-edit
+  name: cozystack-dashboard-cluster-admin
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

packages/system/dashboard/templates/rbac.yaml

@@ -12,16 +12,6 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - core.cozystack.io
-  resources:
-  - tenantmodules
-  - tenantnamespaces
-  - tenantsecrets
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - dashboard.cozystack.io
   resources:
@@ -46,20 +36,6 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - kubevirt.io
-  resources:
-  - virtualmachineinstances
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - subresources.kubevirt.io
-  resources:
-  - virtualmachineinstances/vnc
-  verbs:
-  - get
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding