feat: add RBAC for watching CRDs by controller (#796)

Adds watch and list permissions for 
apiextensions.k8s.io.customresourcedefinitions to controller's ClusterRole to
enable watching CRDs and start reconcilers dynamically once they get installed
implemented in Kong/kubernetes-ingress-controller#3996.

charts/kong/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## Unreleased
+## 2.21.0
 
 ### Improvements
 
@@ -9,6 +9,8 @@
  [#792](https:/Kong/charts/pull/792)
 * Customize Admission Webhook namespaceSelectors and compose them from values.
  [#794](https:/Kong/charts/pull/794)
+* Added `CustomResourceDefinition` `list` and `watch` permissions to controller's ClusterRole.
+ [#796](https:/Kong/charts/pull/796)
 
 ## 2.20.2
 

charts/kong/Chart.yaml

@@ -11,7 +11,7 @@ maintainers:
 name: kong
 sources:
 - https:/Kong/charts/tree/main/charts/kong
-version: 2.20.2
+version: 2.21.0
 appVersion: "3.2"
 dependencies:
 - name: postgresql

charts/kong/templates/_helpers.tpl

@@ -1488,6 +1488,15 @@ Kubernetes Cluster-scoped resources it uses to build Kong configuration.
  - get
  - patch
  - update
+{{- if (semverCompare ">= 2.10.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
+- apiGroups:
+ - apiextensions.k8s.io
+ resources:
+ - customresourcedefinitions
+ verbs:
+ - list
+ - watch
+{{- end }}
 {{- if or (.Capabilities.APIVersions.Has "gateway.networking.k8s.io/v1alpha2") (.Capabilities.APIVersions.Has "gateway.networking.k8s.io/v1beta1") }}
 - apiGroups:
  - gateway.networking.k8s.io