cilium-operator requires the pod:delete permission to manage [core|kube]dns pods that are managed by cilium.

These pods are only managed by cilium if disableEndpointCRD is false.

disableEndpointCRD is false by default, but the operator doesn't get the permission unless you explicitly set disableEndpointCRD to false. This is very unintuitive; I would expect that setting something to false that is false by default should be a noop.

This PR simply removes the explicit hasKey check and leaves the key value checks in, which should be the only ones that matter anyway.

Looks like this check was originally introduced in f612c97 which I think had the right idea – this permission should only exist when delete is needed – but it shouldn't require a user to explicitly re-set a default.

Before this change, with default values:

❯ kubectl describe clusterroles -n cilium cilium-operator | grep pods
  pods                                                   []                 []              [get list watch]

After this change, with default values:

❯ kubectl describe clusterroles -n cilium cilium-operator | grep pods
  pods                                                   []                 []              [get list watch delete]

Explicitly setting disableEndpointCRD to true removes the delete permission.

• For first time contributors, read Submitting a pull request
• All code is covered by unit and/or runtime tests where feasible.
• All commits contain a well written commit description including a title,
  description and a Fixes: #XXX line if the commit addresses a particular
  GitHub issue.
• If your commit description contains a Fixes: <commit-id> tag, then
  please add the commit author[s] as reviewer[s] to this issue.
• All commits are signed off. See the section Developer’s Certificate of Origin
• Provide a title or release-note blurb suitable for the release notes.
• Are you a user of Cilium? Please add yourself to the Users doc
• Thanks for contributing!