SystemExternalLogicalClusterAdmin is a group used by the workspace controllers to manage LogicalCluster resources after creation, using a subset of permissions allowed for the internal logical-cluster-admin.

SystemKcpAdminGroup is global admin group.

SystemKcpWorkspaceAccessGroup is a group that gives a user system:authenticated access to a workspace.

SystemKcpWorkspaceBootstrapper is the group used to bootstrap resources, both during the root setup, as well as when the default APIBinding initializing controller performs its bootstrapping for initializing workspaces.

SystemLogicalClusterAdmin is a group used by the workspace scheduler to create LogicalCluster resources.