RELEASE-2451: Refactor internal-services RBAC layout (redhat-appstudio#374)

Move local-only RBAC resources to extra/ directory to prevent
automated tasks from removing them. The update-internal-services
task overwrites rbac/ with upstream content, but extra/ remains
untouched and is referenced in the parent kustomization.yaml.

Previously, the list of extra resources was hardcoded in the
update-internal-services tekton task, requiring updates to the
task whenever new local-only resources were added.

Changes:
- Create extra/ directories for production and staging
- Move local-only files from rbac/ to extra/:
  - signing-sa.yaml
  - view-authenticated-users.yaml
  - release_team_role.yaml
  - release_team_role_binding.yaml
- Update parent kustomization.yaml to reference extra/
- Update rbac/kustomization.yaml to remove moved resources

Assisted-by: Claude Code

Signed-off-by: Martin Malina <mmalina@redhat.com>

Author: mmalina

components/internal-services/internal-production/extra/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - release_team_role.yaml
+  - release_team_role_binding.yaml
+  - signing-sa.yaml
+  - view-authenticated-users.yaml

…l-production/rbac/release_team_role.yaml …-production/extra/release_team_role.yamlcomponents/internal-services/internal-production/rbac/release_team_role.yaml renamed to components/internal-services/internal-production/extra/release_team_role.yaml components/internal-services/internal-production/rbac/release_team_role.yaml renamed to components/internal-services/internal-production/extra/release_team_role.yaml

@@ -18,5 +18,7 @@ resources:
   - networkpolicy/
   # RBAC Resources
   - rbac/
+  # Extra RBAC Resources (local-only, not managed by automation)
+  - extra/
   # Signing ConfigMaps
   - signing/

…tion/rbac/release_team_role_binding.yaml …ion/extra/release_team_role_binding.yamlcomponents/internal-services/internal-production/rbac/release_team_role_binding.yaml renamed to components/internal-services/internal-production/extra/release_team_role_binding.yaml components/internal-services/internal-production/rbac/release_team_role_binding.yaml renamed to components/internal-services/internal-production/extra/release_team_role_binding.yaml

@@ -23,7 +23,3 @@ resources:
   - internalrequest_viewer_role.yaml
   - internalservicesconfig_editor_role.yaml
   - internalservicesconfig_viewer_role.yaml
-  - view-authenticated-users.yaml
-  - release_team_role.yaml
-  - release_team_role_binding.yaml
-  - signing-sa.yaml

…internal-production/rbac/signing-sa.yaml …nternal-production/extra/signing-sa.yamlcomponents/internal-services/internal-production/rbac/signing-sa.yaml renamed to components/internal-services/internal-production/extra/signing-sa.yaml components/internal-services/internal-production/rbac/signing-sa.yaml renamed to components/internal-services/internal-production/extra/signing-sa.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - release_team_role.yaml
+  - release_team_role_binding.yaml
+  - signing-sa.yaml
+  - view-authenticated-users.yaml