apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  # bind the ClusterRole proxy-role with the ServiceAccount controller-manager, which gives controller-manager the ability of authentication
  name: proxy-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: proxy-role
subjects:
  - kind: ServiceAccount
    # controller-manager of balancer is a ServiceAccount (managed by Kubernetes)
    name: controller-manager
    namespace: system
