awx-local-setup: harden scripts, add chmod helper, fix CI schedule

setup_awx_local.sh

@@ -71,13 +71,10 @@ else
 fi
 
 # create leader-election RBAC if missing
-cat <<'EOF' | (
-  if [ "${DRY_RUN}" = "1" ] || [ "${SKIP_CLUSTER:-0}" = "1" ]; then
-    cat >/dev/null
-  else
-    kubectl apply -n ${AWX_NAMESPACE} -f -
-  fi
-)
+if [ "${DRY_RUN}" = "1" ] || [ "${SKIP_CLUSTER:-0}" = "1" ]; then
+  echo "DRY RUN: skipping creation of leader-election RBAC"
+else
+  kubectl apply -n ${AWX_NAMESPACE} -f - <<'EOF'
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -86,19 +83,7 @@ rules:
 - apiGroups: ["coordination.k8s.io"]
   resources: ["leases"]
   verbs: ["get","create","update","patch","delete","watch","list"]
-EOF
-
-if [ "${DRY_RUN}" = "1" ] || [ "${SKIP_CLUSTER:-0}" = "1" ]; then
-  echo "DRY RUN: would ensure rolebinding awx-operator-leader-election in ${AWX_NAMESPACE}"
-else
-  kubectl get rolebinding awx-operator-leader-election -n ${AWX_NAMESPACE} >/dev/null 2>&1 || cat <<'EOF' | kubectl apply -n ${AWX_NAMESPACE} -f -
-EOF
-fi
-
-if [ "${DRY_RUN}" = "1" ] || [ "${SKIP_CLUSTER:-0}" = "1" ]; then
-  :
-else
-  cat <<'EOF' | kubectl apply -n ${AWX_NAMESPACE} -f -
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
@@ -112,18 +97,6 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
 EOF
 fi
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: awx-operator-leader-election
-subjects:
-- kind: ServiceAccount
-  name: controller-manager
-roleRef:
-  kind: Role
-  name: awx-operator-leader-election
-  apiGroup: rbac.authorization.k8s.io
-EOF
 
 # wait for operator deployment to be available
 echo "Waiting for controller-manager deployment to be available..."