Fix management blueprint kptfile and stop using namespace mode for CNRM.

[jlewi]

• The management blueprint should have its own KptFile

  • Prior to this PR there was only a KptFile at gcp/
  • This doesn't work because for the management cluster we
    only pull the package gcp/v2/management

• Related to Fix the management blueprint GoogleCloudPlatform/kubeflow-distribution#102

• Related to Split/Refactor gcp manifests into separate kpt packages GoogleCloudPlatform/kubeflow-distribution#93

• For CNRM Switch to workload identity and stop using namespace mode for CNRM; Management cluster should not use CNRM in namespaced mode GoogleCloudPlatform/kubeflow-distribution#13

  • Using namespace mode is just extra complexity because we have to install
    a separate copy of the CNRM controller for every project.
    • The only reason to do really do that is if you want to use different
      GCP service accounts to manage different projects. Typically that's
      not what we do.
    • With workload identity we have 1 namespace per project but they
      all use the same GCP SA so the GCP sa can just be authorized to
      access multiple projects or a folder as needed.

• Update the resources to the v1beta1 spec for use with AnthosCLI

  • It looks like anthoscli requires a NodePool resource
  • With the v1beta1 specs we need to add the annotation gke.cluster.io = "bootstrap://" so that anthoscli is able to probably group the resources.

• Move cnrm-install iam and services into kustomize packages

  • This way we can hydrate them like we do other manifests

• Fix the setters and substitutions for CNRM to make them unique per name

  • This way we could potentially have multiple management clusters per project
    which if nothing else will be useful for testing.

[kubeflow-bot]

This change is 

[jlewi]

/assign @Bobgy

[Bobgy]

/lgtm
/approve

[jlewi]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Bobgy, jlewi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jlewi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment