The Custom Resource |MonitorStack| is defined at the Namespace scope
(https://github.com/rhobs/observability-operator/blob/73db74f3f56aa46b775e1b79003c093bb5c24ed6/deploy/crds/common/monitoring.rhobs_monitoringstacks.yaml#L16).
In Kubernetes, this means an account with namespaced Roles and without
ClusterRoles may deploy the Custom Resource.

The corresponding reconciler creates a ServiceAccount with ClusterRole
when deploying |MonitorStack|
(https://github.com/rhobs/observability-operator/blob/73db74f3f56aa46b775e1b79003c093bb5c24ed6/pkg/controllers/monitoring/monitoring-stack/components.go#L76,
https://github.com/rhobs/observability-operator/blob/73db74f3f56aa46b775e1b79003c093bb5c24ed6/pkg/controllers/monitoring/monitoring-stack/components.go#L82),
which means that an adversary with limited access (e.g., a malicious
tenant assigned only Role privileges within his namespace, or a
Kubernetes Workload compromised by an attacker with a Role-privileged
Service Account mounted) to a K8s cluster could deploy the
|MonitorStack| in their authorized namespace and then elevate his
permission to cluster level by impersonating the ServiceAccount created
by the Operator.