Two months ago a change was added that CREATES a ClusterRole when installing with 'namespaced' and with 'gateway' sources configured.

a270a32#diff-60307124dbbd2b5273650b5ee705153da138a0c0677fc190c2e010ddc1420796

For instance, I use Flux, to configure a tenant-based structure where namespaced users can install their own HelmReleases. These HelmReleases do not have cluster-level permissions: and thus cannot have users deploy Helm charts into their namespaces which would create resources outside their namespaces. And especially not ClusterRoles.

And thus they can no longer install the laterest External-DNS charts, when namespaced is true, and enabling gateways.

I'm not sure exactly what the goal of this ClusterRole was.