Minimal Kubernetes resource permissions for uninstall/install/injection using a service account

I am using vault-helm in an Azure Kubernetes environment. Manual provision (install, uninstall, inject, upgrade etc) work fine since I have cluster-admin access but not when using a service account. I am using Azure DevOps pipelines for releases jobs, tasks, provisions, and updates, and the pipeline must use a Kubernetes service account in a cluster namespace.

The jobs are failing due to inadequate RBAC permissions and I want to configure the service account with minimal access permissions in the Cluster and not cluster-admin.

I realized that the way to get around this is to create ClusterRole using ClusterBindings and linking the service account. The uninstallation also needs to remove all vault related Kubernetes resources which are not removed by Helm uninstall. I have activated auditStorage, ClusterIP, injections, and HA using Azure Key Vault as unseal.

I manage to use the release pipeline for uninstall after applying the clusterrole and clusterrolebinding but it fails on the installation tasks. So my question is: **What is the minimal Kubernetes resources permissions for installation, installation, injection of vault-helm using a service account?**

#### Manual installation and uninstallation command
```bash
# Install
helm install vault ./helm/v0.6.0 --values ./helm/values.yaml --namespace utility
# UnInstall
helm uninstall vault --namespace utility
kubectl delete pods,rc,rs,deployment,pvc,svc,sa,statefulsets,clusterroles,clusterrolebinding,mutatingwebhookconfiguration,role,rolebinding --selector="app.kubernetes.io/instance=vault" --all-namespaces --ignore-not-found'
```

#### azuredevops-clusterrole.yaml
```yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: azuredevops-clusterrole
labels:
app.kubernetes.io/name: azuredevops
app.kubernetes.io/instance: azuredevops
app.kubernetes.io/managed-by: vault
rules:
- apiGroups: ["","extensions","apps","rbac.authorization.k8s.io","admissionregistration.k8s.io"]
resources: ["clusterroles","clusterrolebindings","mutatingwebhookconfigurations"," roles","rolebindings","replicationcontrollers","replicasets","deployments","services","serviceaccounts","statefulsets","pods","persistentvolumeclaims","secrets","StorageClass","NetworkPolicy","ConfigMap","PodDisruptionBudget","Ingress","Route","tokenreviews","subjectaccessreviews"]
verbs: ["get", "watch", "list","create", "delete", "update","patch"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["clusterroles"]
verbs: ["bind","escalate"]
resourceNames: ["admin","edit","view"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["clusterrolebindings"]
verbs: ["list","create","delete"]
```
#### azuredevops-clusterrolebindings.yaml
```yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: azuredevops-clusterrolebinding
namespace: utility
labels:
app.kubernetes.io/name: azuredevops
app.kubernetes.io/instance: azuredevops
app.kubernetes.io/managed-by: vault
subjects:
- kind: ServiceAccount
name: azuredevops
namespace: utility
apiGroup: ""
- kind: Group
name: system:authenticated
apiGroup: rbac.authorization.k8s.io
namespace: utility
roleRef:
kind: ClusterRole
name: azuredevops-clusterrole
apiGroup: rbac.authorization.k8s.io
```

Current installation error
```
2020-06-13T08:02:11.9329539Z Error: clusterrolebindings.rbac.authorization.k8s.io "vault-server-binding" is forbidden: user "system:serviceaccount:utility:azuredevops" (groups=["system:serviceaccounts" "system:serviceaccounts:utility" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
2020-06-13T08:02:11.9331149Z {APIGroups:["authentication.k8s.io"], Resources:["tokenreviews"], Verbs:["create"]}
2020-06-13T08:02:11.9331923Z {APIGroups:["authorization.k8s.io"], Resources:["subjectaccessreviews"], Verbs:["create"]}
2020-06-13T08:02:11.9333298Z helm.go:84: [debug] clusterrolebindings.rbac.authorization.k8s.io "vault-server-binding" is forbidden: user "system:serviceaccount:utility:azuredevops" (groups=["system:serviceaccounts" "system:serviceaccounts:utility" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
2020-06-13T08:02:11.9336204Z {APIGroups:["authentication.k8s.io"], Resources:["tokenreviews"], Verbs:["create"]}
2020-06-13T08:02:11.9336969Z {APIGroups:["authorization.k8s.io"], Resources:["subjectaccessreviews"], Verbs:["create"]}_
```

Review the chart manifests under helm/v0.6.0 and compare their RBAC resources with the service account rules shown. Check the installation failure for tokenreviews and subjectaccessreviews, then document the minimal permissions needed for install, uninstall, and injection. Done means the required permissions and their scope are clearly specified.

Written by the indexing model from the issue text.