Merge pull request #1527 from lonelyCZ/pr-proxy-rbac

Add cluster proxy rbac for admin when deploy Karmada control plane

artifacts/deploy/cluster-proxy-admin-rbac.yaml

@@ -0,0 +1,26 @@
+# This configuration is used to authorize system:admin to proxy member clusters,
+# if you don't need it, you can remove it from karmada control plane.
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cluster-proxy-admin
+rules:
+- apiGroups:
+  - 'cluster.karmada.io'
+  resources:
+  - clusters/proxy
+  verbs:
+  - '*'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cluster-proxy-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-proxy-admin
+subjects:
+  - kind: User
+    name: "system:admin"

hack/deploy-karmada.sh

@@ -227,6 +227,9 @@ kubectl apply -f "${REPO_ROOT}/artifacts/deploy/apiservice.yaml"
 # make sure apiservice for v1alpha1.cluster.karmada.io is Available
 util::wait_apiservice_ready "${KARMADA_AGGREGATION_APISERVER_LABEL}"
 
+# deploy cluster proxy rbac for admin
+kubectl apply -f "${REPO_ROOT}/artifacts/deploy/cluster-proxy-admin-rbac.yaml"
+
 kubectl config use-context "${HOST_CLUSTER_NAME}"
 
 # deploy controller-manager on host cluster