Issue Description:

Create a placementrule for selecting all clusters. All other managed clusters are selected, but the local-cluster is not selected.

Version-Release number of selected component (if applicable): 2.1.z


How reproducible: Always


Steps to Reproduce:
1. Create a GRC policy with no labels on the placement rule
2. Its observed that the policy gets deployed on all the managedclusters except for the local-cluster

Actual results:

Policy is not deployed on the local-cluster

Expected results:

Policies should be deployed on the local-cluster too.

Additional info:

// list all managed clusters
% oc get managedclusters 
NAME            HUB ACCEPTED   MANAGED CLUSTER URLS   JOINED   AVAILABLE   AGE
local-cluster   true                                  True     True        56d
cluster1    true                                  True     True        16h

// only cluster1 is selected by the placementrule.
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: all-ready-clusters
  namespace: default
spec:
  clusterSelector: {}
status:
  decisions:
  - clusterName: cluster1
    clusterNamespace: cluster1
Root cause
The placementrule user is not granted to create deployables resources in the local-cluster namespace, while it is granted in other manged cluster namespaces.

Workaround:

Create a Role for granting the deployable admin permission in the local-cluster namespace. Then create a RoleBinding to grant the placementrule user to the role.

// Create a Role for granting the deployable admin permission in the local-cluster namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: deployables-admin-user-zisis
  namespace: local-cluster
rules:
- apiGroups:
  - apps.open-cluster-management.io
  resources:
  - deployables
  verbs:
  - '*'

// Create a RoleBinding to bind the placementrule user to the Role as above
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: deployables-admin-user-zisis
  namespace: local-cluster
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: deployables-admin-user-zisis
  namespace: local-cluster
subjects:
- kind: User
  name: zisis
  apiGroup: rbac.authorization.k8s.io