Add routes and multi-vif resources to Kuryr's CR

This commit adds routes and network-attachment-definitions resources to
kuryr-controller ClusterRole. Without that we wouldn't be able to access
them though ServiceAccount token, so features depending on those
wouldn't be working in containerized deployments.

Change-Id: Ifd0322b0ec7951d281fdae6e9e08c4356177b06d
Partial-Bug: 1796122

devstack/lib/kuryr_kubernetes

@@ -496,20 +496,27 @@ rules:
   - ""
   verbs: ["*"]
   resources:
-    - deployments
     - endpoints
     - ingress
     - pods
-    - policies
     - nodes
     - services
     - services/status
     - namespaces
+- apiGroups: ["oapi"]
+  resources:
+  - routes
+  verbs: ["*"]
 - apiGroups:
     - openstack.org
   verbs: ["*"]
   resources:
     - kuryrnets
+- apiGroups: ["k8s.cni.cncf.io"]
+  resources:
+  - network-attachment-definitions
+  verbs:
+  - get
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1