diff --git a/config/crds/iam.kubesphere.io_rolebases.yaml b/config/crds/iam.kubesphere.io_rolebases.yaml
index 35183c630..8b70b38ad 100644
--- a/config/crds/iam.kubesphere.io_rolebases.yaml
+++ b/config/crds/iam.kubesphere.io_rolebases.yaml
@@ -32,6 +32,8 @@ spec:
             type: object
           role:
             type: object
+            x-kubernetes-embedded-resource: true
+            x-kubernetes-preserve-unknown-fields: true
         required:
         - role
         type: object
diff --git a/staging/src/kubesphere.io/api/iam/v1alpha2/types.go b/staging/src/kubesphere.io/api/iam/v1alpha2/types.go
index 8243641bb..d5167698b 100644
--- a/staging/src/kubesphere.io/api/iam/v1alpha2/types.go
+++ b/staging/src/kubesphere.io/api/iam/v1alpha2/types.go
@@ -283,7 +283,8 @@ type WorkspaceRoleBindingList struct {
 type RoleBase struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
-
+	// +kubebuilder:pruning:PreserveUnknownFields
+	// +kubebuilder:validation:EmbeddedResource
 	Role runtime.RawExtension `json:"role"`
 }