install: grant Cilium operator permissions to update ingress finalizers

This is required when the OwnerReferencesPermissionEnforcement admission
plugin is set, because the operator creates CiliumEnvoyConfig resources
owned by the corresponding ingress, with the blockOwnerDeletion flag set.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>

Author: giorio94

install/kubernetes/cilium/templates/cilium-operator/clusterrole.yaml

@@ -323,6 +323,10 @@ rules:
   - networking.k8s.io
   resources:
   - ingresses/status # To update ingress status with load balancer IP.
+  # The controller needs to be able to set ingress finalizers to be able to create a CiliumEnvoyConfig
+  # resource that is owned by the ingress, and set blockOwnerDeletion=true in its ownerRef.
+  # This is required when the admission plugin OwnerReferencesPermissionEnforcement is activated.
+  - ingresses/finalizers
   verbs:
   - update
 {{- end }}