diff --git a/staging/src/kubesphere.io/api/iam/v1beta1/category_types.go b/staging/src/kubesphere.io/api/iam/v1beta1/category_types.go
new file mode 100644
index 000000000..1e7c07168
--- /dev/null
+++ b/staging/src/kubesphere.io/api/iam/v1beta1/category_types.go
@@ -0,0 +1,54 @@
+/*
+Copyright 2023.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
+
+// CategorySpec defines the desired state of Category
+type CategorySpec struct {
+	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+
+	DisplayName map[string]string `json:"displayName,omitempty"`
+	Description map[string]string `json:"description,omitempty"`
+	Icon        string            `json:"icon,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+//+kubebuilder:resource:categories=iam,scope=Cluster
+
+// Category is the Schema for the categories API
+type Category struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec CategorySpec `json:"spec,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// CategoryList contains a list of Category
+type CategoryList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []Category `json:"items"`
+}
diff --git a/staging/src/kubesphere.io/api/iam/v1beta1/clusterrole_types.go b/staging/src/kubesphere.io/api/iam/v1beta1/clusterrole_types.go
new file mode 100644
index 000000000..d03563beb
--- /dev/null
+++ b/staging/src/kubesphere.io/api/iam/v1beta1/clusterrole_types.go
@@ -0,0 +1,49 @@
+/*
+Copyright 2023.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
+
+//+kubebuilder:object:root=true
+//+kubebuilder:resource:categories=iam,scope=Cluster
+
+// ClusterRole is the Schema for the clusterroles API
+type ClusterRole struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// AggregationRoleTemplates means which RoleTemplates are composed this Role
+	AggregationRoleTemplates AggregationRoleTemplates `json:"aggregationRoleTemplates,omitempty"`
+
+	// Rules holds all the PolicyRules for this WorkspaceRole
+	Rules rbacv1.PolicyRule `json:"rules,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// ClusterRoleList contains a list of ClusterRole
+type ClusterRoleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ClusterRole `json:"items"`
+}
diff --git a/staging/src/kubesphere.io/api/iam/v1beta1/globalrole_types.go b/staging/src/kubesphere.io/api/iam/v1beta1/globalrole_types.go
new file mode 100644
index 000000000..b55eefefa
--- /dev/null
+++ b/staging/src/kubesphere.io/api/iam/v1beta1/globalrole_types.go
@@ -0,0 +1,58 @@
+/*
+Copyright 2023.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
+
+type AggregationRoleTemplates struct {
+	// TemplateNames select rules from RoleTemplate`s rules by RoleTemplate name
+	TemplateNames []string `json:"templateNames,omitempty"`
+
+	// Selector select rules from RoleTemplate`s rules by labels
+	Selector metav1.LabelSelector `json:"selector,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+//+kubebuilder:resource:categories=iam,scope=Cluster
+
+// GlobalRole is the Schema for the globalroles API
+type GlobalRole struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// AggregationRoleTemplates means which RoleTemplates are composed this Role
+	AggregationRoleTemplates AggregationRoleTemplates `json:"aggregationRoleTemplates,omitempty"`
+
+	// Rules holds all the PolicyRules for this WorkspaceRole
+	Rules rbacv1.PolicyRule `json:"rules"`
+}
+
+//+kubebuilder:object:root=true
+
+// GlobalRoleList contains a list of GlobalRole
+type GlobalRoleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []GlobalRole `json:"items"`
+}
diff --git a/staging/src/kubesphere.io/api/iam/v1beta1/register.go b/staging/src/kubesphere.io/api/iam/v1beta1/register.go
new file mode 100644
index 000000000..4def0c5bd
--- /dev/null
+++ b/staging/src/kubesphere.io/api/iam/v1beta1/register.go
@@ -0,0 +1,64 @@
+/*
+Copyright 2023.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1beta1 contains API Schema definitions for the iam v1beta1 API group
+// +k8s:openapi-gen=true
+// +kubebuilder:object:generate=true
+// +groupName=iam.kubesphere.io
+
+package v1beta1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var (
+	// SchemeGroupVersion is group version used to register these objects
+	SchemeGroupVersion = schema.GroupVersion{Group: "iam.kubesphere.io", Version: "v1beta1"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+
+	// AddToScheme is required by pkg/client/...
+	AddToScheme = SchemeBuilder.AddToScheme
+)
+
+// Resource is required by pkg/client/listers/...
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Category{},
+		&CategoryList{},
+		&Role{},
+		&RoleList{},
+		&ClusterRole{},
+		&ClusterRoleList{},
+		&WorkspaceRole{},
+		&WorkspaceRoleList{},
+		&GlobalRole{},
+		&GlobalRoleList{},
+		&RoleTemplate{},
+		&RoleTemplateList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/staging/src/kubesphere.io/api/iam/v1beta1/role_types.go b/staging/src/kubesphere.io/api/iam/v1beta1/role_types.go
new file mode 100644
index 000000000..f26e7f44e
--- /dev/null
+++ b/staging/src/kubesphere.io/api/iam/v1beta1/role_types.go
@@ -0,0 +1,49 @@
+/*
+Copyright 2023.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
+
+//+kubebuilder:object:root=true
+//+kubebuilder:resource:categories=iam,scope=Namspaced
+
+// Role is the Schema for the roles API
+type Role struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// AggregationRoleTemplates means which RoleTemplates are composed this Role
+	AggregationRoleTemplates AggregationRoleTemplates `json:"aggregationRoleTemplates,omitempty"`
+
+	// Rules holds all the PolicyRules for this WorkspaceRole
+	Rules rbacv1.PolicyRule `json:"rules,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// RoleList contains a list of Role
+type RoleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []Role `json:"items"`
+}
diff --git a/staging/src/kubesphere.io/api/iam/v1beta1/roletemplate_types.go b/staging/src/kubesphere.io/api/iam/v1beta1/roletemplate_types.go
new file mode 100644
index 000000000..0a2eba7fa
--- /dev/null
+++ b/staging/src/kubesphere.io/api/iam/v1beta1/roletemplate_types.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2023.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
+
+// RoleTemplateSpec defines the desired state of RoleTemplate
+type RoleTemplateSpec struct {
+	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+
+	// DisplayName represent the name displays at console, this field
+	DisplayName map[string]string   `json:"displayName,omitempty"`
+	Description map[string]string   `json:"description,omitempty"`
+	Rules       []rbacv1.PolicyRule `json:"rules"`
+}
+
+//+kubebuilder:object:root=true
+//+kubebuilder:resource:categories=iam,scope=Cluster
+
+// RoleTemplate is the Schema for the roletemplates API
+type RoleTemplate struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec RoleTemplateSpec `json:"spec,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// RoleTemplateList contains a list of RoleTemplate
+type RoleTemplateList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []RoleTemplate `json:"items"`
+}
diff --git a/staging/src/kubesphere.io/api/iam/v1beta1/workspacerole_types.go b/staging/src/kubesphere.io/api/iam/v1beta1/workspacerole_types.go
new file mode 100644
index 000000000..d60c8b8e7
--- /dev/null
+++ b/staging/src/kubesphere.io/api/iam/v1beta1/workspacerole_types.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2023.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
+
+//+kubebuilder:object:root=true
+//+kubebuilder:resource:categories=iam,scope=Cluster
+//+kubebuilder:printcolumn:name="Workspace",type="string",JSONPath=".metadata.labels.kubesphere\\.io/workspace"
+//+kubebuilder:printcolumn:name="Alias",type="string",JSONPath=".metadata.annotations.kubesphere\\.io/alias-name"
+
+// WorkspaceRole is the Schema for the workspaceroles API
+type WorkspaceRole struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// AggregationRoleTemplates means which RoleTemplates are composed this Role
+	AggregationRoleTemplates AggregationRoleTemplates `json:"aggregationRoleTemplates,omitempty"`
+
+	// Rules holds all the PolicyRules for this WorkspaceRole
+	Rules rbacv1.PolicyRule `json:"rules,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// WorkspaceRoleList contains a list of WorkspaceRole
+type WorkspaceRoleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []WorkspaceRole `json:"items"`
+}
diff --git a/staging/src/kubesphere.io/api/iam/v1beta1/zz_generated.deepcopy.go b/staging/src/kubesphere.io/api/iam/v1beta1/zz_generated.deepcopy.go
new file mode 100644
index 000000000..f29ceefb7
--- /dev/null
+++ b/staging/src/kubesphere.io/api/iam/v1beta1/zz_generated.deepcopy.go
@@ -0,0 +1,465 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	"k8s.io/api/rbac/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AggregationRoleTemplates) DeepCopyInto(out *AggregationRoleTemplates) {
+	*out = *in
+	if in.TemplateNames != nil {
+		in, out := &in.TemplateNames, &out.TemplateNames
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	in.Selector.DeepCopyInto(&out.Selector)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AggregationRoleTemplates.
+func (in *AggregationRoleTemplates) DeepCopy() *AggregationRoleTemplates {
+	if in == nil {
+		return nil
+	}
+	out := new(AggregationRoleTemplates)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Category) DeepCopyInto(out *Category) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Category.
+func (in *Category) DeepCopy() *Category {
+	if in == nil {
+		return nil
+	}
+	out := new(Category)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Category) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CategoryList) DeepCopyInto(out *CategoryList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Category, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CategoryList.
+func (in *CategoryList) DeepCopy() *CategoryList {
+	if in == nil {
+		return nil
+	}
+	out := new(CategoryList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CategoryList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CategorySpec) DeepCopyInto(out *CategorySpec) {
+	*out = *in
+	if in.DisplayName != nil {
+		in, out := &in.DisplayName, &out.DisplayName
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Description != nil {
+		in, out := &in.Description, &out.Description
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CategorySpec.
+func (in *CategorySpec) DeepCopy() *CategorySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(CategorySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterRole) DeepCopyInto(out *ClusterRole) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.AggregationRoleTemplates.DeepCopyInto(&out.AggregationRoleTemplates)
+	in.Rules.DeepCopyInto(&out.Rules)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterRole.
+func (in *ClusterRole) DeepCopy() *ClusterRole {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterRole)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterRole) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterRoleList) DeepCopyInto(out *ClusterRoleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ClusterRole, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterRoleList.
+func (in *ClusterRoleList) DeepCopy() *ClusterRoleList {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterRoleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterRoleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GlobalRole) DeepCopyInto(out *GlobalRole) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.AggregationRoleTemplates.DeepCopyInto(&out.AggregationRoleTemplates)
+	in.Rules.DeepCopyInto(&out.Rules)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalRole.
+func (in *GlobalRole) DeepCopy() *GlobalRole {
+	if in == nil {
+		return nil
+	}
+	out := new(GlobalRole)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GlobalRole) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GlobalRoleList) DeepCopyInto(out *GlobalRoleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]GlobalRole, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalRoleList.
+func (in *GlobalRoleList) DeepCopy() *GlobalRoleList {
+	if in == nil {
+		return nil
+	}
+	out := new(GlobalRoleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GlobalRoleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Role) DeepCopyInto(out *Role) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.AggregationRoleTemplates.DeepCopyInto(&out.AggregationRoleTemplates)
+	in.Rules.DeepCopyInto(&out.Rules)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Role.
+func (in *Role) DeepCopy() *Role {
+	if in == nil {
+		return nil
+	}
+	out := new(Role)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Role) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RoleList) DeepCopyInto(out *RoleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Role, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleList.
+func (in *RoleList) DeepCopy() *RoleList {
+	if in == nil {
+		return nil
+	}
+	out := new(RoleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RoleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RoleTemplate) DeepCopyInto(out *RoleTemplate) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleTemplate.
+func (in *RoleTemplate) DeepCopy() *RoleTemplate {
+	if in == nil {
+		return nil
+	}
+	out := new(RoleTemplate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RoleTemplate) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RoleTemplateList) DeepCopyInto(out *RoleTemplateList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]RoleTemplate, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleTemplateList.
+func (in *RoleTemplateList) DeepCopy() *RoleTemplateList {
+	if in == nil {
+		return nil
+	}
+	out := new(RoleTemplateList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RoleTemplateList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RoleTemplateSpec) DeepCopyInto(out *RoleTemplateSpec) {
+	*out = *in
+	if in.DisplayName != nil {
+		in, out := &in.DisplayName, &out.DisplayName
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Description != nil {
+		in, out := &in.Description, &out.Description
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]v1.PolicyRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleTemplateSpec.
+func (in *RoleTemplateSpec) DeepCopy() *RoleTemplateSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(RoleTemplateSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkspaceRole) DeepCopyInto(out *WorkspaceRole) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.AggregationRoleTemplates.DeepCopyInto(&out.AggregationRoleTemplates)
+	in.Rules.DeepCopyInto(&out.Rules)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkspaceRole.
+func (in *WorkspaceRole) DeepCopy() *WorkspaceRole {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkspaceRole)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *WorkspaceRole) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkspaceRoleList) DeepCopyInto(out *WorkspaceRoleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]WorkspaceRole, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkspaceRoleList.
+func (in *WorkspaceRoleList) DeepCopy() *WorkspaceRoleList {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkspaceRoleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *WorkspaceRoleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}