Update example helm charts with SelfSubjectAccessReview permissions

The new permission is there to allow the proxy to self-test
impersonation powers at startup and surface RBAC problems early.

examples/chart/teleport-auto-trustedcluster/templates/clusterrole.yaml

@@ -14,4 +14,10 @@ rules:
   - serviceaccounts
   verbs:
   - impersonate
+- apiGroups:
+  - "authorization.k8s.io"
+  resources:
+  - selfsubjectaccessreviews
+  verbs:
+  - create
 {{- end -}}

examples/chart/teleport-daemonset/templates/clusterrole.yaml

@@ -14,6 +14,12 @@ rules:
   - serviceaccounts
   verbs:
   - impersonate
+- apiGroups:
+  - "authorization.k8s.io"
+  resources:
+  - selfsubjectaccessreviews
+  verbs:
+  - create
 {{ if .Values.usePSP -}}
 ---
 apiVersion: rbac.authorization.k8s.io/v1

examples/chart/teleport-demo/templates/generic/teleport-k8s.yaml

@@ -18,6 +18,12 @@ rules:
   - groups
   verbs:
   - impersonate
+- apiGroups:
+  - "authorization.k8s.io"
+  resources:
+  - selfsubjectaccessreviews
+  verbs:
+  - create
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
@@ -115,4 +121,4 @@ subjects:
   name: teleport-users
 {{- end -}}
 {{- end -}}
-{{- end }}
+{{- end }}

examples/chart/teleport/templates/clusterrole.yaml

@@ -14,4 +14,10 @@ rules:
   - serviceaccounts
   verbs:
   - impersonate
+- apiGroups:
+  - "authorization.k8s.io"
+  resources:
+  - selfsubjectaccessreviews
+  verbs:
+  - create
 {{- end -}}