rbac: allow full fetcher role provisioning in dynamic namespaces

deploy/multitenant/rbac.yaml

@@ -43,6 +43,13 @@ subjects:
 ---
 # ClusterRole: allows fission-executor to create/update fission-fetcher SA,
 # Role and RoleBinding in any user namespace managed by NSWatcher.
+#
+# It also needs two less-obvious permissions:
+#   1. localsubjectaccessreviews.create — setupSAAndRoleBindings checks whether
+#      the target SA already has each permission before creating missing rules.
+#   2. events.create — Kubernetes forbids creating a Role that grants permissions
+#      the caller does not currently hold. Since fission-fetcher gets events.create,
+#      fission-executor must hold it too in order to create that Role.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -55,6 +62,12 @@ rules:
   - apiGroups: [""]
     resources: ["serviceaccounts"]
     verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create"]
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["localsubjectaccessreviews"]
+    verbs: ["create"]
   - apiGroups: ["rbac.authorization.k8s.io"]
     resources: ["roles", "rolebindings"]
     verbs: ["get", "list", "watch", "create", "update", "patch"]