fix(rbac): grant kubeadm bootstrap SA read on KamajiControlPlane (CAPI v1.14.0)

Signed-off-by: Victor Hang <victor@stackhpc.com>

Author: Banh-Canh

config/control-plane-components.yaml

@@ -15394,6 +15394,27 @@ subjects:
   name: capi-kamaji-controller-manager
   namespace: kamaji-system
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: cluster-api-control-plane-provider-kamaji
+    app.kubernetes.io/instance: manager-rolebinding
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: clusterrolebinding
+    app.kubernetes.io/part-of: cluster-api-control-plane-provider-kamaji
+    cluster.x-k8s.io/provider: kamaji
+  name: capi-kamaji-capi-kamaji-control-plane-kubeadm-bootstrap-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: capi-kamaji-capi-kamaji-control-plane-role
+subjects:
+- kind: ServiceAccount
+  name: capi-kubeadm-bootstrap-manager
+  namespace: capi-kubeadm-bootstrap-system
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:

config/rbac/capi_kubeadm_bootstrap_role_binding.yaml

@@ -0,0 +1,33 @@
+# As of Cluster API v1.14.0 (kubernetes-sigs/cluster-api#13433, "Write kubeadm
+# control plane version file for workers to use to fetch the matching kubeadm
+# binary") the kubeadm bootstrap controller resolves the control-plane Kubernetes
+# version by reading the object referenced by `Cluster.spec.controlPlaneRef`.
+# When a Cluster uses a KamajiControlPlane, the bootstrap controller issues a
+# `get kamajicontrolplanes.controlplane.cluster.x-k8s.io`, which otherwise fails
+# with:
+#   failed to read control plane version: ... kamajicontrolplanes... is forbidden:
+#   User "system:serviceaccount:capi-kubeadm-bootstrap-system:capi-kubeadm-bootstrap-manager"
+#   cannot get resource "kamajicontrolplanes" in API group "controlplane.cluster.x-k8s.io"
+#
+# The bootstrap controller reads via an APIReader (no /status), so the
+# get/list/watch rules already present in capi_role.yaml are sufficient; we bind
+# that same ClusterRole to the kubeadm bootstrap manager ServiceAccount.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: clusterrolebinding
+    app.kubernetes.io/instance: manager-rolebinding
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: cluster-api-control-plane-provider-kamaji
+    app.kubernetes.io/part-of: cluster-api-control-plane-provider-kamaji
+    app.kubernetes.io/managed-by: kustomize
+  name: capi-kamaji-control-plane-kubeadm-bootstrap-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: capi-kamaji-control-plane-role
+subjects:
+- kind: ServiceAccount
+  name: capi-kubeadm-bootstrap-manager
+  namespace: capi-kubeadm-bootstrap-system

config/rbac/kustomization.yaml

@@ -13,3 +13,6 @@ resources:
 # as well as to read the instance statuses.
 - capi_role.yaml
 - capi_role_binding.yaml
+# Since Cluster API v1.14.0 the kubeadm bootstrap controller reads the
+# KamajiControlPlane to resolve the control-plane version (upstream #13433).
+- capi_kubeadm_bootstrap_role_binding.yaml