Allow work agent to be run on different identity

[qiujian16]

Currently work agent is run as an admin on the spoke. We should consider let user to define another identity in the manifestwork, so a manifestwork can be executed on the spoke with lower privilege.

• check the executor subject permission for action apply
• check the executor subject permission for action delete
• cache the subject access review results
• add a webhook to check the execute-as permission on the hub cluster

[qiujian16]

/assign @yue9944882

[qiujian16]

/kind feature

[zhujian7]

I'd like to work on this

• check the executor subject permission for action apply #153
• check the executor subject permission for action delete #154
• cache the subject access review results #155
• add a validate webhook to check the execute-as permission on the hub cluster #156

proposal link: https://github.com/open-cluster-management-io/enhancements/tree/main/enhancements/sig-architecture/34-work-executor-group

[qiujian16]

/assign @zhujian7

[zhujian7]

/close

[openshift-ci]

@zhujian7: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.