@a7i Thanks a lot for your feedback!

To be fair, we should have never propagated this role (since it's a system role)

I agree with you that propagate system Role don't seem to have a reasonable usage scenario. We should consider banning propagation system Role (and other RBAC resources, including RoleBinding, ClusterRole, and ClusterRoleBinding).

By the way, how did you discover the problem? Are you trying to propagate a system Role?

@XiShanYongYe-Chang that is correct, I accidentally propagated a system role.

With that being said, :: is valid in names for clusterrole/clusterolebinding/roles/rolebindings. See example below:

$ kubectl create role "foo::bar" --verb=get --resource=pods

role.rbac.authorization.k8s.io/foo::bar created

$ kubectl get role "foo::bar" -oyaml

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: foo::bar
  namespace: default
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get

Ask @RainbowMango to help take a look.

Karmada replaces colon with dot (not sure why),

That is because the CRD resources can not accept names with :, the comments here explained the reason.

This is indeed a tradeoff to do the replacement. :(

To be fair, we should have never propagated this role (since it's a system role), but regardless it should be sanitized.

The trouble is that we can not assume there is one or two colons in the name. There may be more.

Echo from https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-subjects:

Caution: The prefix system: is reserved for Kubernetes system use, so you should ensure that you don't have users or groups with names that start with system: by accident. Other than this special prefix, the RBAC authorization system does not require any format for usernames.

Given the RBAC system doesn't require any format, that means the users might create resources with any number of colons, like:

# kubectl create role "foo:::bar" --verb=get --resource=pods  // 3 colons
role.rbac.authorization.k8s.io/foo:::bar created
# kubectl create role "foo::::bar" --verb=get --resource=pods // 4 colons
role.rbac.authorization.k8s.io/foo::::bar created
# # kubectl create role "foo:::::bar" --verb=get --resource=pods // 5 colons
role.rbac.authorization.k8s.io/foo:::::bar created

How do we handle these cases? Or shall we handle that?

Perhaps we could replace : with - instead of .

Given that fo----bar is still a valid domain

This is a feasible method.

Perhaps we could replace : with - instead of .

Yeah, but it might be a breaking change incompatible with previous versions. That is concerning. right?