Looks like the upgrade E2E test does not work well with changes like this, since when deploying the "old" version of the Operator, the old RBAC for the Operator itself isn't applied, so it's using the "new" RBAC with the "old" Operator.
The upgrade test really needs to fully deploy the old version, including all YAML manifests, and then do a full upgrade by applying all of the new manifests, to handle changes like this. Just changing the image tag is not sufficient here.
Looks like the upgrade E2E test does not work well with changes like this, since when deploying the "old" version of the Operator, the old RBAC for the Operator itself isn't applied, so it's using the "new" RBAC with the "old" Operator.
Originally posted by @skriss in https://github.com/projectcontour/contour-operator/issues/435#issuecomment-909390461
The upgrade test really needs to fully deploy the old version, including all YAML manifests, and then do a full upgrade by applying all of the new manifests, to handle changes like this. Just changing the image tag is not sufficient here.