This ticket is to enhance the ClusterPermission status to also check and report on the status of the ManifestWork that each ClusterPermission creates. ManifestWork is a separate k8s resource that handles the actual work of ClusterPermission by creating the rolebindings on the specified cluster. Even if ClusterPermission shows an "all green" status, there still could be issues with the ClusterPermission that can only be seen from the ManifestWork statuses (which are separate). The pain point here is that a customer could create a ClusterPermission which shows "all green" success statuses from UI (going off of ClusterPermission statuses), however the RoleBindings fail to get created and the failed status is only observable from the ManifestWork. In this scenario, we would be saying everything is good when in fact it is not, so a bit misleading.

The specific ManifestWork to check can be seen in the ClusterPermission status. It provides a kubectl command to run.