Description of problem:
As a used with cluster-reader role I should be able to read resources connected with cluster's network configuration. In this case, I want access to NodeNetworkConfigurationPolicy, NodeNetworkConfigurationEnactment and NodeNetworkState. This is however not possible today.


Version-Release number of selected component (if applicable):
OpenShift 4.8, 4.9


How reproducible:
Always


Steps to Reproduce:
1. Bind an unprivileged user with cluster-reader role
2. Log in as such user
3. List NNS (oc get nns)

Actual results:
The list fails due to the lack of privileges.


Expected results:
The user should be able to list and read these resources, just as nnce and nncp.


Additional info:
This can be accomplished through aggregated roles. Similar to this role used for NAD:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: net-attach-def-project
  labels:
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
- apiGroups: ["k8s.cni.cncf.io"]
  resources: ["network-attachment-definitions"]
  verbs: ["watch", "list"]

This must be deployed only if the target role is available.