fix: CRD permissions

- Add missing description
- Remove `get`, it is never used
- Make list/watch unconditional

Author: NickLarsenNZ

deploy/helm/druid-operator/templates/roles.yaml

@@ -94,21 +94,22 @@ rules:
       - get
       - list
       - patch
+  # Required for maintaining the CRDs within the operator (including the conversion webhook info).
+  # Also for the startup condition check before the controller can run.
   - apiGroups:
       - apiextensions.k8s.io
     resources:
       - customresourcedefinitions
     verbs:
-      - get
       # Required to maintain the CRD. The operator needs to do this, as it needs to enter e.g. it's
       # generated certificate in the conversion webhook.
       {{- if .Values.maintenance.customResourceDefinitions.maintain }}
       - create
       - patch
+      {{- end }}
       # Required for startup condition
       - list
       - watch
-      {{- end }}
   # Listener created per role group for external access. Applied via SSA and tracked for orphan
   # cleanup. Not watched by the controller (no .owns() or .watches() on Listener in main.rs).
   - apiGroups: