rbac: allow router namespace watch in multi-tenant mode

deploy/multitenant/rbac.yaml

@@ -1,11 +1,13 @@
 # deploy/multitenant/rbac.yaml
 #
-# RBAC required for the Fission multi-tenant NSWatcher.
+# RBAC required for the Fission multi-tenant NSWatcher components.
 #
-# The fission-executor ServiceAccount must be allowed to list and watch Namespaces
-# at the cluster scope so that NSWatcher can detect newly-labeled Namespaces.
+# Both fission-executor and fission-router must be allowed to list and watch
+# Namespaces at the cluster scope so that their NSWatchers can detect newly-
+# labeled Namespaces.
 #
-# This is a read-only ClusterRole — no write permissions are granted.
+# The executor also needs additional write permissions to provision the
+# fission-fetcher ServiceAccount/Role/RoleBinding in new namespaces.
 # Apply once per cluster after installing Fission:
 #
 #   kubectl apply -f deploy/multitenant/rbac.yaml
@@ -41,6 +43,36 @@ subjects:
     name: fission-executor
     namespace: fission
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: fission-router-ns-watcher
+  labels:
+    app.kubernetes.io/name: fission
+    app.kubernetes.io/component: router
+    app.kubernetes.io/part-of: fission-multitenant
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: fission-router-ns-watcher
+  labels:
+    app.kubernetes.io/name: fission
+    app.kubernetes.io/component: router
+    app.kubernetes.io/part-of: fission-multitenant
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: fission-router-ns-watcher
+subjects:
+  - kind: ServiceAccount
+    name: fission-router
+    namespace: fission
+---
 # ClusterRole: allows fission-executor to create/update fission-fetcher SA,
 # Role and RoleBinding in any user namespace managed by NSWatcher.
 #