From 6d508be9f4a0d9fa6821187548e0515f24170200 Mon Sep 17 00:00:00 2001
From: Scot Wells <wells.scot@gmail.com>
Date: Tue, 7 Jul 2026 21:36:41 -0500
Subject: [PATCH] feat(federation): add minimal edge-scoped ClusterRole for
 cell write-back
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The edge (cell) compute-manager authenticates to the hub Karmada control plane
with a dedicated client-cert identity (system:compute-edge-federation@compute.datumapis.com)
to write Instance status back for its cell. Grant it a new, least-privilege
ClusterRole rather than the broad compute-manager role the management plane uses.

The role is scoped to exactly what the cell InstanceReconciler's FederationClient
does on the hub (Finalize + writeBackToUpstream): read the federation namespace,
and create/update/delete its own Instance plus update its status. The cell uses a
direct (non-caching) client, so no list/watch — and it never touches
configmaps/secrets, workloaddeployments, or propagationpolicies on the hub.

Bound to the identity by CN specifically, not the broad compute.datumapis.com
group, so only this identity receives the edge role. Ships in the existing
downstream-rbac kustomization so it applies to Karmada alongside the management
role.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../downstream-rbac/edge-federation-rbac.yaml | 49 +++++++++++++++++++
 .../base/downstream-rbac/kustomization.yaml   |  1 +
 2 files changed, 50 insertions(+)
 create mode 100644 config/base/downstream-rbac/edge-federation-rbac.yaml

diff --git a/config/base/downstream-rbac/edge-federation-rbac.yaml b/config/base/downstream-rbac/edge-federation-rbac.yaml
new file mode 100644
index 00000000..c5ea1aad
--- /dev/null
+++ b/config/base/downstream-rbac/edge-federation-rbac.yaml
@@ -0,0 +1,49 @@
+# Least-privilege federation access for the edge (cell) compute-manager on the
+# Karmada control plane. This is a dedicated ClusterRole — deliberately NOT the
+# broad compute-manager role above (which the management plane needs) — scoped to
+# what the cell InstanceReconciler's FederationClient does on the hub in Finalize
+# + writeBackToUpstream (internal/controller/instance_controller.go):
+#
+#   * Get the federation Namespace to resolve write-back identity labels.
+#   * Get / Create / Update / Delete this cell's own write-back Instance.
+#   * Update the write-back Instance's status.
+#
+# The cell uses a direct (non-caching) federation client, so no list/watch is
+# required, and it never touches configmaps/secrets, workloaddeployments, or
+# propagationpolicies on the hub. (The functional minimum is get/create/update/
+# delete on instances + update on instances/status; the extra patch/status-get
+# verbs mirror the role first shipped in infra#3202 so this relocation is a
+# faithful, thrash-free move — patch is a partial-update peer of update.)
+#
+# Bound to the dedicated edge identity by CN specifically — the client cert the
+# infra deployment control plane issues (CN
+# system:compute-edge-federation@compute.datumapis.com) — not to the broad
+# compute.datumapis.com group, so only this identity receives the edge role.
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: compute-edge-federation
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get"]
+  - apiGroups: ["compute.datumapis.com"]
+    resources: ["instances"]
+    verbs: ["get", "create", "update", "patch", "delete"]
+  - apiGroups: ["compute.datumapis.com"]
+    resources: ["instances/status"]
+    verbs: ["get", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: compute-edge-federation
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: compute-edge-federation
+subjects:
+  - kind: User
+    name: system:compute-edge-federation@compute.datumapis.com
+    apiGroup: rbac.authorization.k8s.io
diff --git a/config/base/downstream-rbac/kustomization.yaml b/config/base/downstream-rbac/kustomization.yaml
index 4c4dbe44..45f515c2 100644
--- a/config/base/downstream-rbac/kustomization.yaml
+++ b/config/base/downstream-rbac/kustomization.yaml
@@ -3,3 +3,4 @@ kind: Kustomization
 
 resources:
   - rbac.yaml
+  - edge-federation-rbac.yaml