✨ Add kubeadm cluster role

[abhay-nutanix]

This PR backports kubeadm RBAC permission reconciliation to control plane upgrade paths by introducing/ensuring the kubeadm cluster role bindings needed during version transitions.

How was this tested

1. Build and Prepare Controller Images
   Build Targets: Compiled the CAPI core, Kubeadm bootstrap, Kubeadm control plane (KCP), and Docker infrastructure (CAPD) controller manager binaries into local container images using make.

Tag Matching: Retagged local container images to match the exact versions expected by the local repository templates and manifests (e.g., local.test/capi/...:v1.10.99 and :v1.10.x-dev).

2. Set Up the Management Cluster (Kind)
   Docker Socket Mounting: Configured a Kind cluster definition (kind-cluster-with-docker.yaml) with /var/run/docker.sock mounted into the node so CAPD could manage Docker containers directly on the host.

Preloading Images: Loaded all built container images directly into the Kind cluster (kind load docker-image ... --name capi-mgmt).

Provider Initialization: Initialized Cluster API using ./bin/clusterctl init pointing to the local repository (infrastructure-docker, kubeadm-control-plane, kubeadm-bootstrap, and cluster-api).

Image Pull Policy Patching: Patched all four controller deployments to imagePullPolicy: IfNotPresent to prevent Kubernetes from attempting to pull non-existent local.test URLs over the network.

3. Local Repository Setup & Manifest Generation
   Template Setup: Copied required cluster definitions and ClusterClasses (cluster-template-development.yaml as cluster-template.yaml and clusterclass-quick-start.yaml) into the local provider repository path (~/.cluster-api/overrides/ / local-repository/).

Workload Cluster Manifest Generation: Generated and applied the test cluster YAML using:

./bin/clusterctl generate cluster test-docker \
  --infrastructure docker \
  --kubernetes-version v1.30.0 \
  --control-plane-machine-count 1 \
  --worker-machine-count 1 | kubectl apply -f -

4. Workload Cluster Networking & Host Access
   Kubeconfig Retrieval: Extracted the workload cluster kubeconfig using ./bin/clusterctl get kubeconfig test-docker > test-docker.kubeconfig.

Port-Forwarding Adjustment: Replaced the unreachable internal Docker container IP (172.18.0.x:6443) in the kubeconfig with the host port exposed by test-docker-lb on Docker Desktop (e.g., 127.0.0.1:55000).

CNI Installation: Applied Calico to the workload cluster to allow nodes to transition to Ready and initialize system pods.

5. Final PR Testing & Verification
   Unit Testing: Ran package-level tests via go test for workload_cluster_rbac_test.go to test RBAC logic in isolation.

Workload Cluster Inspection: Verified the creation of kubeadm-managed ClusterRoles and ClusterRoleBindings (such as kubeadm:cluster-admins introduced in PR kubernetes-sigs#13664) directly on the workload cluster.

Drift / Self-Healing Test: Deleted the managed RBAC object (kubeadm:cluster-admins) from the workload cluster, triggered a KCP reconciliation loop on the management cluster, and verified that KCP successfully restored the deleted resource.

[shivendra-ntnx]

Shouldn't we check for nil

[shivendra-ntnx]

why?