fix: RBAC bind cluster-admin + list namespaces + TEST_MODE multi-tenant test

deploy/rbac/console-ns-manager.yaml

@@ -5,13 +5,19 @@ metadata:
 rules:
 - apiGroups: [""]
   resources: ["namespaces"]
-  verbs: ["get", "create"]
+  verbs: ["get", "create", "list"]
 - apiGroups: ["fission.io"]
   resources: ["*"]
   verbs: ["*"]
 - apiGroups: ["rbac.authorization.k8s.io"]
   resources: ["rolebindings"]
   verbs: ["get", "create"]
+# bind позволяет создавать RoleBindings ссылающиеся на cluster-admin
+# без необходимости самому иметь все его права (RBAC escalation prevention)
+- apiGroups: ["rbac.authorization.k8s.io"]
+  resources: ["clusterroles"]
+  resourceNames: ["cluster-admin"]
+  verbs: ["bind"]
 - apiGroups: ["apps"]
   resources: ["deployments"]
   verbs: ["get", "patch"]