docs/k8s: add instructions on how to run as a sidecar or a proxy.

Signed-off-by: Maisem Ali <maisem@tailscale.com>

docs/k8s/role.yaml

@@ -1,10 +1,16 @@
+# Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  namespace: default
   name: tailscale
 rules:
 - apiGroups: [""] # "" indicates the core API group
-  resourceNames: ["tailscale"]
   resources: ["secrets"]
-  verbs: ["create", "get", "update"]
+  # Create can not be restricted to a resource name.
+  verbs: ["create"]
+- apiGroups: [""] # "" indicates the core API group
+  resourceNames: ["{{KUBE_SECRET}}"]
+  resources: ["secrets"]
+  verbs: ["get", "update"]