Rather than granting cluster-admin which we only needed to list and get CRDs, (which we do in order for the client to reflectively discover leaf and project APIs, yay kubeclient!)
Add "update" for our CRD resources since it seems to be used by kubeclient as well
Rather than granting cluster-admin which we only needed to list and get CRDs, (which we do in order for the client to reflectively discover leaf and project APIs, yay kubeclient!)
Add "update" for our CRD resources since it seems to be used by kubeclient as well