WHAT

• Allow the controller to watch Secrets / ConfigMaps in the single namespace mode.
• Enable the k8s API client cache for Secrets / ConfigMaps in the single namespace mode.

WHY

The EphemeralRunnerReconciler retrieves a JITConfig Secret for every reconciliation once the Secret is created for a reconciling runner. It can be a performance bottleneck because the cache of the k8s API client is disabled for Secrets, and the client has a rate limiter with QPS=20.

The cache is disabled for Secrets because it requires cluster-wide list/watch permissions in the default mode. But in the single namespace mode, we can narrow down the permissions only to the single namespace and the controller namespace, which would be acceptable.

This change is aligned with ADR 2023-04-11: Limit Permissions for Service Accounts in Actions-Runner-Controller.

In this mode, you will end up with a manager Role that has all Get/List/Create/Delete/Update/Patch/Watch permissions on resources we need, and a RoleBinding to bind the Role with the controller ServiceAccount in the watched single namespace and the controller namespace