fix(rbac): grant kubeadm bootstrap SA read on KamajiControlPlane (CAPI v1.14.0)

Signed-off-by: Victor Hang <victor@stackhpc.com>

Author: Banh-Canh

config/control-plane-components.yaml

@@ -15394,6 +15394,27 @@ subjects:
   name: capi-kamaji-controller-manager
   namespace: kamaji-system
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: cluster-api-control-plane-provider-kamaji
+    app.kubernetes.io/instance: manager-rolebinding
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: clusterrolebinding
+    app.kubernetes.io/part-of: cluster-api-control-plane-provider-kamaji
+    cluster.x-k8s.io/provider: kamaji
+  name: capi-kamaji-capi-kamaji-control-plane-kubeadm-bootstrap-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: capi-kamaji-capi-kamaji-control-plane-role
+subjects:
+- kind: ServiceAccount
+  name: capi-kubeadm-bootstrap-manager
+  namespace: capi-kubeadm-bootstrap-system
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:

config/rbac/capi_kubeadm_bootstrap_role_binding.yaml

@@ -0,0 +1,19 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: clusterrolebinding
+    app.kubernetes.io/instance: manager-rolebinding
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: cluster-api-control-plane-provider-kamaji
+    app.kubernetes.io/part-of: cluster-api-control-plane-provider-kamaji
+    app.kubernetes.io/managed-by: kustomize
+  name: capi-kamaji-control-plane-kubeadm-bootstrap-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: capi-kamaji-control-plane-role
+subjects:
+  - kind: ServiceAccount
+    name: capi-kubeadm-bootstrap-manager
+    namespace: capi-kubeadm-bootstrap-system

config/rbac/kustomization.yaml

@@ -13,3 +13,6 @@ resources:
 # as well as to read the instance statuses.
 - capi_role.yaml
 - capi_role_binding.yaml
+# Since Cluster API v1.14.0 the kubeadm bootstrap controller reads the
+# KamajiControlPlane to resolve the control-plane version (upstream #13433).
+- capi_kubeadm_bootstrap_role_binding.yaml