[BUG]Two examples of oam: flight-tracker and dependency do not authorize oam's permissions to crd, so the example will not run.

[linjiemiao]

When I deploy flight-tracker, oam does not have permission to ingress, so it will report an error:

	oam-kubernetes-runtime	Cannot apply components	{"controller": "oam/applicationconfiguration.core.oam.dev", "request": "default/service-tracker", "uid": "30f8793c-5359-4e46-ab4b-f0b034838c5e", "version": "149846771", "error": "cannot apply trait \"extensions/v1beta1\" \"Ingress\" \"tracker-ingress\": cannot get object: ingresses.extensions \"tracker-ingress\" is forbidden: User \"system:serviceaccount:oam-system:oam-kubernetes-runtime-core-runtime\" cannot get resource \"ingresses\" in API group \"extensions\" in the namespace \"default\"", "errorVerbose": "ingresses.extensions \"tracker-ingress\" is forbidden: User \"system:serviceaccount:oam-system:oam-kubernetes-runtime-core-runtime\" cannot get resource \"ingresses\" in API group \"extensions\" in the namespace \"default\"\ncannot get object\ngithub.com/crossplane/crossplane-runtime/pkg/resource.(*APIPatchingApplicator).Apply\n\t/go/pkg/mod/github.com/crossplane/crossplane-runtime@v0.8.0/pkg/resource/api.go:145\ngithub.com/crossplane/oam-kubernetes-runtime/pkg/controller/v1alpha2/applicationconfiguration.(*workloads).Apply\n\t/workspace/pkg/controller/v1alpha2/applicationconfiguration/apply.go:96\ngithub.com/crossplane/oam-kubernetes-runtime/pkg/controller/v1alpha2/applicationconfiguration.(*OAMApplicationReconciler).Reconcile\n\t/workspace/pkg/controller/v1alpha2/applicationconfiguration/applicationconfiguration.go:274\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.6.0/pkg/internal/controller/controller.go:256\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.6.0/pkg/internal/controller/controller.go:232\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).worker\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.6.0/pkg/internal/controller/controller.go:211\nk8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1\n\t/go/pkg/mod/k8s.io/apimachinery@v0.18.5/pkg/util/wait/wait.go:155\nk8s.io/apimachinery/pkg/util/wait.BackoffUntil\n\t/go/pkg/mod/k8s.io/apimachinery@v0.18.5/pkg/util/wait/wait.go:156\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\t/go/pkg/mod/k8s.io/apimachinery@v0.18.5/pkg/util/wait/wait.go:133\nk8s.io/apimachinery/pkg/util/wait.Until\n\t/go/pkg/mod/k8s.io/apimachinery@v0.18.5/pkg/util/wait/wait.go:90\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1357\ncannot apply trait \"extensions/v1beta1\" \"Ingress\" \"tracker-ingress\"\ngithub.com/crossplane/oam-kubernetes-runtime/pkg/controller/v1alpha2/applicationconfiguration.(*workloads).Apply\n\t/workspace/pkg/controller/v1alpha2/applicationconfiguration/apply.go:97\ngithub.com/crossplane/oam-kubernetes-runtime/pkg/controller/v1alpha2/applicationconfiguration.(*OAMApplicationReconciler).Reconcile\n\t/workspace/pkg/controller/v1alpha2/applicationconfiguration/applicationconfiguration.go:274\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.6.0/pkg/internal/controller/controller.go:256\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.6.0/pkg/internal/controller/controller.go:232\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).worker\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.6.0/pkg/internal/controller/controller.go:211\nk8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1\n\t/go/pkg/mod/k8s.io/apimachinery@v0.18.5/pkg/util/wait/wait.go:155\nk8s.io/apimachinery/pkg/util/wait.BackoffUntil\n\t/go/pkg/mod/k8s.io/apimachinery@v0.18.5/pkg/util/wait/wait.go:156\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\t/go/pkg/mod/k8s.io/apimachinery@v0.18.5/pkg/util/wait/wait.go:133\nk8s.io/apimachinery/pkg/util/wait.Until\n\t/go/pkg/mod/k8s.io/apimachinery@v0.18.5/pkg/util/wait/wait.go:90\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1357", "requeue-after": "2020-10-23T03:16:14.764Z"}

So we need to add a ClusterRole with label rbac.oam.dev/aggregate-to-controller: "true" to the example。
A similar problem exists in the dependency example

[wonderflow]

Thanks for your report, this bug was exactly what you descirbed, would you like to send a PR? @linjiemiao

[linjiemiao]

Thanks for your report, this bug was exactly what you descirbed, would you like to send a PR? @linjiemiao

ok, i will send a pr