OCPBUGS-31353: Minimize wildcard privileges for CRDs and namespaces

- Restricted CRD permissions exclusively to Gateway API.
- Restricted namespace permissions exclusively to operand namespaces (routers and canary).

manifests/00-cluster-role.yaml

@@ -15,7 +15,6 @@ rules:
   - ""
   resources:
   - configmaps
-  - namespaces
   - serviceaccounts
   - endpoints
   - services
@@ -25,6 +24,16 @@ rules:
   verbs:
   - "*"
 
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  resourceNames:
+  - openshift-ingress
+  - openshift-ingress-canary
+  verbs:
+  - "*"
+
 - apiGroups:
   - ""
   resources:
@@ -171,6 +180,11 @@ rules:
   - apiextensions.k8s.io
   resources:
   - customresourcedefinitions
+  resourceNames:
+  - gatewayclasses.gateway.networking.k8s.io
+  - gateways.gateway.networking.k8s.io
+  - httproutes.gateway.networking.k8s.io
+  - referencegrants.gateway.networking.k8s.io
   verbs:
   - '*'