This is necessary even if the controller is otherwise restricted to
a namespace. So we add a new ClusterRole to add the RBAC read rights
(wath, list and get) unconditionally for any controller instance.