feat(federation): add minimal edge-scoped ClusterRole for cell write-back

The edge (cell) compute-manager authenticates to the hub Karmada control plane
with a dedicated client-cert identity (system:compute-edge-federation@compute.datumapis.com)
to write Instance status back for its cell. Grant it a new, least-privilege
ClusterRole rather than the broad compute-manager role the management plane uses.

The role is scoped to exactly what the cell InstanceReconciler's FederationClient
does on the hub (Finalize + writeBackToUpstream): read the federation namespace,
and create/update/delete its own Instance plus update its status. The cell uses a
direct (non-caching) client, so no list/watch — and it never touches
configmaps/secrets, workloaddeployments, or propagationpolicies on the hub.

Bound to the identity by CN specifically, not the broad compute.datumapis.com
group, so only this identity receives the edge role. Ships in the existing
downstream-rbac kustomization so it applies to Karmada alongside the management
role.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: scotwells

config/base/downstream-rbac/edge-federation-rbac.yaml

@@ -0,0 +1,46 @@
+# Least-privilege federation access for the edge (cell) compute-manager on the
+# Karmada control plane. This is a NEW, dedicated ClusterRole — deliberately NOT
+# the broad compute-manager role above (which the management plane needs) —
+# scoped to exactly what the cell InstanceReconciler's FederationClient does on
+# the hub in Finalize + writeBackToUpstream (internal/controller/instance_controller.go):
+#
+#   * Get the federation Namespace to resolve write-back identity labels.
+#   * Get / Create / Update / Delete this cell's own write-back Instance.
+#   * Update the write-back Instance's status.
+#
+# The cell uses a direct (non-caching) federation client, so no list/watch is
+# required, and it never touches configmaps/secrets, workloaddeployments, or
+# propagationpolicies on the hub.
+#
+# Bound to the dedicated edge identity by CN specifically — the client cert the
+# infra deployment control plane issues (CN
+# system:compute-edge-federation@compute.datumapis.com) — not to the broad
+# compute.datumapis.com group, so only this identity receives the edge role.
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: compute-edge-federation
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get"]
+  - apiGroups: ["compute.datumapis.com"]
+    resources: ["instances"]
+    verbs: ["get", "create", "update", "delete"]
+  - apiGroups: ["compute.datumapis.com"]
+    resources: ["instances/status"]
+    verbs: ["update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: compute-edge-federation
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: compute-edge-federation
+subjects:
+  - kind: User
+    name: system:compute-edge-federation@compute.datumapis.com
+    apiGroup: rbac.authorization.k8s.io

config/base/downstream-rbac/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 
 resources:
   - rbac.yaml
+  - edge-federation-rbac.yaml