When a Monitoring stack with a non-empty namespaceSelector is created, the controller also creates a ClusterRoleBinding for the Prometheus SA. This grants far reaching authorization which users can abuse by impersonating the Prometheus SA.

A CRB is not always needed if the MonitoringStack only should monitor a known list of namespaces. Since we don't want to maintain a watch on namespaces (can cause memory issues) but give users the option to avoid the potential security issue, we should have a config to instruct the operator to not create the CRB and leave it to the user to create the needed RoleBindings in the desired namespaces.