Missing RBAC on finalizers sub-resources when OwnerReferencesPermissionEnforcement admission is enabled

[astefanutti]

What happened:

On clusters, like OpenShift, where the OwnerReferencesPermissionEnforcement admission controller is enabled, reconciliation of workloads failed with the following error message:

"error":"workloads.kueue.x-k8s.io \"pytorchjob-pytorch-simple-7a162\" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: , <nil>"

What you expected to happen:

The Kueue service account should have the required permissions to update the finalizers.

How to reproduce it (as minimally and precisely as possible):

Create a workload on a cluster that has the OwnerReferencesPermissionEnforcement admission controller enabled.

[astefanutti]

/assign