chore(fleet): drop the cross-cluster reader identity

The collector runs inside lux-k8s now and reads pods with its own in-cluster
ServiceAccount, so the ServiceAccount + ClusterRole + three RoleBindings this
file created for an out-of-cluster observer have no consumer. Applying it again
would only mint another long-lived cluster-read token nobody uses.

Revoked on the cluster too: the lux-k8s RBAC is deleted and the kubeconfig
Secret on bootnode-k8s is gone — the token it held now gets 401.

Co-authored-by: Hanzo Dev <[email protected]>

infra/k8s/lux-fleet-reader-rbac.yaml

@@ -1,99 +0,0 @@
-# Read-only lux-k8s identity for the Lux Fleet API.
-#
-# APPLIED TO do-sfo3-lux-k8s (not bootnode-k8s, where the workload runs). The
-# fleet collector lives on bootnode-k8s and observes lux-k8s across the cluster
-# boundary, so it needs a credential there. This grants the least privilege that
-# still answers "what is the fleet doing?":
-#
-#   pods            get/list  — phase, readiness, pod IP
-#   pods/proxy      get       — GET  luxd /v1/health
-#                   create    — POST luxd JSON-RPC (/v1/info, /v1/bc/C/rpc, ...)
-#   luxnetworks     get       — declared validators, image tag, plugin set
-#
-# No write verbs on any real object, no secrets, no exec, no scale, and the
-# binding is limited to the three luxd namespaces. pods/proxy `create` is how
-# the k8s API expresses "POST through the proxy"; it creates nothing.
-#
-# Mint the kubeconfig the workload mounts with:
-#
-#   kubectl --context=do-sfo3-lux-k8s -n bootnode \
-#     create token lux-fleet-reader --duration=87600h
-#
-# then write it into bootnode-k8s as secret/lux-k8s-reader-kubeconfig (key
-# `kubeconfig`) in namespace bootnode.
-
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: bootnode
-
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: lux-fleet-reader
-  namespace: bootnode
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: lux-fleet-reader
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list"]
-  # GET reaches luxd /v1/health; POST (expressed as `create`) reaches its
-  # JSON-RPC. Neither creates a Kubernetes object.
-  - apiGroups: [""]
-    resources: ["pods/proxy"]
-    verbs: ["get", "create"]
-  - apiGroups: ["lux.cloud"]
-    resources: ["luxnetworks"]
-    verbs: ["get", "list"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: lux-fleet-reader
-  namespace: lux-mainnet
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: lux-fleet-reader
-subjects:
-  - kind: ServiceAccount
-    name: lux-fleet-reader
-    namespace: bootnode
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: lux-fleet-reader
-  namespace: lux-testnet
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: lux-fleet-reader
-subjects:
-  - kind: ServiceAccount
-    name: lux-fleet-reader
-    namespace: bootnode
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: lux-fleet-reader
-  namespace: lux-devnet
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: lux-fleet-reader
-subjects:
-  - kind: ServiceAccount
-    name: lux-fleet-reader
-    namespace: bootnode