The operator only transfers a predefined set of labels over to the
database Pods, therefore using matchLabels here, will result in a
non-functional network policy.

The System Upgrade Controller (SUC) tries to adopt the CRD, requiring
writing permissions, when it can read the CRD. Since we deploy the CRD
anyway, and SUC doesn't need to adopt the CRD. If it can't read CRDs it
just assumes they are all in order, therefore not trying to adopt them.

Therefore this patch removes the permission preventing errors.