[feature request] add tenant isolation for components such as kube-proxy&flannel which run in ns kube-system

[MrGirl]

What would you like to be added: a signal which show the tenant identity of kube-proxy&flannel

Why is this needed: Isolation for resources like service and endpoint

others
/kind feature

[rambohe-ch]

@MrGirl Thank you for raising issue. and i'd like to add some backgrounds for multi tenant isolation feature in OpenYurt.

• feature comes from some IoT end users
• multi end users can share the control plane and have his own edge nodes and resources.

in the other word, end user wants to share a OpenYurt cluster, join his edge nodes into the cluster and deploy apps on this own edge nodes. at the same time, every end user can get his own resources only from cluster by native K8s API.

[rambohe-ch]

Based on the original service account in kube-system namespace, end user can list all resource from cluster, In order to prevent resource leak in a tenant isolation cluster, we need to make sure that only resource of specified end user and resource in common namespace can be exposed to specified end user. so the feature in this issue is used to provide this ability.