core-landing-zone needs additional yakima gke roles iam.serviceAccountAdmin and iam.organizationRoleAdmin for GKEFirewallAdmin custom role for example

fix:
- add any least priv role that has iam.roles.get at the org level
- roles/iam.securityAdmin
- roles/iam.organizationRoleViewer
- roles/iam.organizationRoleAdmin
- add any role that has iam.serviceAccounts.create
- roles/iam.serviceAccountAdmin
- roles/iam.serviceAccountCreator
see
- https://cloud.google.com/iam/docs/understanding-roles

Fixing in 3 places
- https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/gh446-hub/solutions/setup.sh#L183
- https://github.com/ssc-spc-ccoe-cei/gcp-tools/blob/main/scripts/bootstrap/configure-kcc-access.sh#L29
- https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/main/docs/landing-zone-v2/README.md#gke-standard

obrien.industries via full script
- clean cluster
- clean core-landing-zone

```
michael@cloudshell:~/kcc-oi/github/pubsec-declarative-toolkit/solutions (kcc-oi-629)$ kubectl describe iamserviceaccount.iam.cnrm.cloud.google.com/gatekeeper-admin-sa

Warning UpdateFailed 36s (x9 over 6m44s) iamserviceaccount-controller Update call failed: error applying desired state: summary: Error creating service account: googleapi: Error 403: Permission 'iam.serviceAccounts.create' denied on resource (or it may not exist).

checking sa permissions for
iam.serviceAccounts.create
```
wrong project number

```
michael@cloudshell:~/kcc-oi/github/pubsec-declarative-toolkit/solutions (kcc-oi-629)$ gcloud projects list --filter="kcc-oi-629" '--format=value(PROJECT_NUMBER)'
1020702930278
```

adding single service account admin role to the yakima gke account to test the reconcile

re-kpt
```
UpdateFailed: 8
UpToDate: 36
Context "gke_kcc-oi-629_northamerica-northeast1_krmapihost-kcc-oi3" modified.
Active namespace is "config-control".
NAME AGE READY STATUS STATUS AGE
iamcustomrole.iam.cnrm.cloud.google.com/gke-firewall-admin 25m False UpdateFailed 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier2-dnsrecord-admin 25m False UpdateFailed 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier2-vpcpeering-admin 25m False UpdateFailed 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier3-dnsrecord-admin 25m False UpdateFailed 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier3-firewallrule-admin 25m False UpdateFailed 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier3-subnetwork-admin 25m False UpdateFailed 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier3-vpcsc-admin 25m False UpdateFailed 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier4-secretmanager-admin 25m False UpdateFailed 25m

NAME AGE READY STATUS STATUS AGE
iampartialpolicy.iam.cnrm.cloud.google.com/gatekeeper-admin-sa-workload-identity-binding 25m True UpToDate 5m28s
iampartialpolicy.iam.cnrm.cloud.google.com/hierarchy-sa-workload-identity-binding 25m True UpToDate 5m28s
iampartialpolicy.iam.cnrm.cloud.google.com/logging-sa-workload-identity-binding 25m True UpToDate 5m27s
iampartialpolicy.iam.cnrm.cloud.google.com/networking-sa-workload-identity-binding 25m True UpToDate 4m21s
iampartialpolicy.iam.cnrm.cloud.google.com/policies-sa-workload-identity-binding 25m True UpToDate 4m15s
iampartialpolicy.iam.cnrm.cloud.google.com/projects-sa-workload-identity-binding 25m True UpToDate 5m26s

NAME AGE READY STATUS STATUS AGE
iampolicymember.iam.cnrm.cloud.google.com/config-control-sa-management-project-editor-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/config-control-sa-management-project-serviceaccountadmin-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/config-control-sa-orgroleadmin-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/gatekeeper-admin-sa-metric-writer-permissions 25m True UpToDate 4m21s
iampolicymember.iam.cnrm.cloud.google.com/hierarchy-sa-folderadmin-permissions 25m True UpToDate 5m3s
iampolicymember.iam.cnrm.cloud.google.com/logging-sa-bigqueryadmin-permissions 25m True UpToDate 4m43s
iampolicymember.iam.cnrm.cloud.google.com/logging-sa-logadmin-permissions 25m True UpToDate 5m9s
iampolicymember.iam.cnrm.cloud.google.com/networking-sa-dns-permissions 25m True UpToDate 4m43s
iampolicymember.iam.cnrm.cloud.google.com/networking-sa-networkadmin-permissions 25m True UpToDate 4m42s
iampolicymember.iam.cnrm.cloud.google.com/networking-sa-security-permissions 25m True UpToDate 4m38s
iampolicymember.iam.cnrm.cloud.google.com/networking-sa-service-control-org-permissions 25m True UpToDate 4m54s
iampolicymember.iam.cnrm.cloud.google.com/networking-sa-servicedirectoryeditor-permissions 25m True UpToDate 4m37s
iampolicymember.iam.cnrm.cloud.google.com/networking-sa-xpnadmin-permissions 25m True UpToDate 4m54s
iampolicymember.iam.cnrm.cloud.google.com/policies-sa-orgpolicyadmin-permissions 25m True UpToDate 2m54s
iampolicymember.iam.cnrm.cloud.google.com/projects-sa-billinguser-permissions 25m True UpToDate 4m54s
iampolicymember.iam.cnrm.cloud.google.com/projects-sa-projectcreator-permissions 25m True UpToDate 4m15s
iampolicymember.iam.cnrm.cloud.google.com/projects-sa-projectdeleter-permissions 25m True UpToDate 4m14s
iampolicymember.iam.cnrm.cloud.google.com/projects-sa-projectiamadmin-permissions 25m True UpToDate 4m14s
iampolicymember.iam.cnrm.cloud.google.com/projects-sa-projectmover-permissions 25m True UpToDate 4m14s
iampolicymember.iam.cnrm.cloud.google.com/projects-sa-serviceusageadmin-permissions 25m True UpToDate 4m14s

NAME AGE READY STATUS STATUS AGE
iamserviceaccount.iam.cnrm.cloud.google.com/gatekeeper-admin-sa 25m True UpToDate 5m29s
iamserviceaccount.iam.cnrm.cloud.google.com/hierarchy-sa 25m True UpToDate 5m29s
iamserviceaccount.iam.cnrm.cloud.google.com/logging-sa 25m True UpToDate 5m28s
iamserviceaccount.iam.cnrm.cloud.google.com/networking-sa 25m True UpToDate 5m28s
iamserviceaccount.iam.cnrm.cloud.google.com/policies-sa 25m True UpToDate 4m15s
iamserviceaccount.iam.cnrm.cloud.google.com/projects-sa 25m True UpToDate 5m27s

NAME AGE READY STATUS STATUS AGE
service.serviceusage.cnrm.cloud.google.com/kcc-oi-629-accesscontextmanager 25m True UpToDate 25m
service.serviceusage.cnrm.cloud.google.com/kcc-oi-629-cloudbilling 25m True UpToDate 25m
service.serviceusage.cnrm.cloud.google.com/kcc-oi-629-cloudresourcemanager 25m True UpToDate 25m
service.serviceusage.cnrm.cloud.google.com/kcc-oi-629-serviceusage 25m True UpToDate 25m
```

fixed
- next one
- https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/main/solutions/core-landing-zone/org/custom-roles/gke-firewall-admin.yaml#L21
```
iamcustomrole.iam.cnrm.cloud.google.com/gke-firewall-admin

michael@cloudshell:~/kcc-oi/github/pubsec-declarative-toolkit/solutions (kcc-oi-629)$ kubectl describe iamcustomrole.iam.cnrm.cloud.google.com/gke-firewall-admin

"permission": "iam.roles.get",
Warning UpdateFailed 1s (x23 over 34m) iamcustomrole-controller Update call failed: error fetching live state: error reading underlying resource: summary: Error when reading or editing organizations/459065442144/roles/gke.firewall.admin: googleapi: Error 403: You don't have permission to get the role at organizations/459065442144/roles/gke.firewall.admin.

```

## adding organization role administrator

fixed
```
michael@cloudshell:~/kcc-oi/github/pubsec-declarative-toolkit/solutions (kcc-oi-629)$ kubectl get gcp
NAME AGE READY STATUS STATUS AGE
iamcustomrole.iam.cnrm.cloud.google.com/gke-firewall-admin 47m True UpToDate 90s
iamcustomrole.iam.cnrm.cloud.google.com/tier2-dnsrecord-admin 47m True UpToDate 90s
iamcustomrole.iam.cnrm.cloud.google.com/tier2-vpcpeering-admin 47m True UpToDate 90s
iamcustomrole.iam.cnrm.cloud.google.com/tier3-dnsrecord-admin 47m True UpToDate 90s
iamcustomrole.iam.cnrm.cloud.google.com/tier3-firewallrule-admin 47m True UpToDate 91s
iamcustomrole.iam.cnrm.cloud.google.com/tier3-subnetwork-admin 47m True UpToDate 90s
iamcustomrole.iam.cnrm.cloud.google.com/tier3-vpcsc-admin 47m True UpToDate 90s
iamcustomrole.iam.cnrm.cloud.google.com/tier4-secretmanager-admin 47m True UpToDate 90s
```