diff --git a/operator/v1/0000_00_operator.open-cluster-management.io_klusterlets.crd.yaml b/operator/v1/0000_00_operator.open-cluster-management.io_klusterlets.crd.yaml
index 395099c03..abc55f53a 100644
--- a/operator/v1/0000_00_operator.open-cluster-management.io_klusterlets.crd.yaml
+++ b/operator/v1/0000_00_operator.open-cluster-management.io_klusterlets.crd.yaml
@@ -135,8 +135,13 @@ spec:
                   description: WorkConfiguration contains the configuration of work
                   type: object
                   properties:
+                    clusterRoles:
+                      description: ClusterRoles is the clusterroles that work agent binds to. If it is empty, the default admin clusterrole in kubernetes is bound to the work agent.
+                      type: array
+                      items:
+                        type: string
                     featureGates:
-                      description: "FeatureGates represents the list of feature gates for work If it is set empty, default feature gates will be used. If it is set, featuregate/Foo is an example of one item in FeatureGates:   1. If featuregate/Foo does not exist, registration-operator will discard it   2. If featuregate/Foo exists and is false by default. It is now possible to set featuregate/Foo=[false|true]   3. If featuregate/Foo exists and is true by default. If a cluster-admin upgrading from 1 to 2 wants to continue having featuregate/Foo=false,  \the can set featuregate/Foo=false before upgrading. Let's say the cluster-admin wants featuregate/Foo=false."
+                      description: "FeatureGates represents the list of feature gates for work agent If it is set empty, default feature gates will be used. If it is set, featuregate/Foo is an example of one item in FeatureGates:   1. If featuregate/Foo does not exist, registration-operator will discard it   2. If featuregate/Foo exists and is false by default. It is now possible to set featuregate/Foo=[false|true]   3. If featuregate/Foo exists and is true by default. If a cluster-admin upgrading from 1 to 2 wants to continue having featuregate/Foo=false,  \the can set featuregate/Foo=false before upgrading. Let's say the cluster-admin wants featuregate/Foo=false."
                       type: array
                       items:
                         type: object
diff --git a/operator/v1/0001_00_operator.open-cluster-management.io_klusterlets.crd.yaml b/operator/v1/0001_00_operator.open-cluster-management.io_klusterlets.crd.yaml
index 52c509ef5..ddedcbc46 100644
--- a/operator/v1/0001_00_operator.open-cluster-management.io_klusterlets.crd.yaml
+++ b/operator/v1/0001_00_operator.open-cluster-management.io_klusterlets.crd.yaml
@@ -135,8 +135,13 @@ spec:
               description: WorkConfiguration contains the configuration of work
               type: object
               properties:
+                clusterRoles:
+                  description: ClusterRoles is the clusterroles that work agent binds to. If it is empty, the default admin clusterrole in kubernetes is bound to the work agent.
+                  type: array
+                  items:
+                    type: string
                 featureGates:
-                  description: "FeatureGates represents the list of feature gates for work If it is set empty, default feature gates will be used. If it is set, featuregate/Foo is an example of one item in FeatureGates:   1. If featuregate/Foo does not exist, registration-operator will discard it   2. If featuregate/Foo exists and is false by default. It is now possible to set featuregate/Foo=[false|true]   3. If featuregate/Foo exists and is true by default. If a cluster-admin upgrading from 1 to 2 wants to continue having featuregate/Foo=false,  \the can set featuregate/Foo=false before upgrading. Let's say the cluster-admin wants featuregate/Foo=false."
+                  description: "FeatureGates represents the list of feature gates for work agent If it is set empty, default feature gates will be used. If it is set, featuregate/Foo is an example of one item in FeatureGates:   1. If featuregate/Foo does not exist, registration-operator will discard it   2. If featuregate/Foo exists and is false by default. It is now possible to set featuregate/Foo=[false|true]   3. If featuregate/Foo exists and is true by default. If a cluster-admin upgrading from 1 to 2 wants to continue having featuregate/Foo=false,  \the can set featuregate/Foo=false before upgrading. Let's say the cluster-admin wants featuregate/Foo=false."
                   type: array
                   items:
                     type: object
diff --git a/operator/v1/types.go b/operator/v1/types.go
index 4182331d0..c14f95125 100644
--- a/operator/v1/types.go
+++ b/operator/v1/types.go
@@ -343,7 +343,7 @@ type KlusterletSpec struct {
 
 	// WorkConfiguration contains the configuration of work
 	// +optional
-	WorkConfiguration *WorkConfiguration `json:"workConfiguration,omitempty"`
+	WorkConfiguration *KlusterletWorkConfiguration `json:"workConfiguration,omitempty"`
 
 	// HubApiServerHostAlias contains the host alias for hub api server.
 	// registration-agent and work-agent will use it to communicate with hub api server.
@@ -351,6 +351,23 @@ type KlusterletSpec struct {
 	HubApiServerHostAlias *HubApiServerHostAlias `json:"hubApiServerHostAlias,omitempty"`
 }
 
+// KlusterletWorkConfiguration contains the configuration of work agent
+type KlusterletWorkConfiguration struct {
+	// ClusterRoles is the clusterroles that work agent binds to. If it is empty, the default admin clusterrole
+	// in kubernetes is bound to the work agent.
+	ClusterRoles []string `json:"clusterRoles,omitempty"`
+
+	// FeatureGates represents the list of feature gates for work agent
+	// If it is set empty, default feature gates will be used.
+	// If it is set, featuregate/Foo is an example of one item in FeatureGates:
+	//   1. If featuregate/Foo does not exist, registration-operator will discard it
+	//   2. If featuregate/Foo exists and is false by default. It is now possible to set featuregate/Foo=[false|true]
+	//   3. If featuregate/Foo exists and is true by default. If a cluster-admin upgrading from 1 to 2 wants to continue having featuregate/Foo=false,
+	//  	he can set featuregate/Foo=false before upgrading. Let's say the cluster-admin wants featuregate/Foo=false.
+	// +optional
+	FeatureGates []FeatureGate `json:"featureGates,omitempty"`
+}
+
 // ServerURL represents the apiserver url and ca bundle that is accessible externally
 type ServerURL struct {
 	// URL is the url of apiserver endpoint of the managed cluster.
diff --git a/operator/v1/zz_generated.deepcopy.go b/operator/v1/zz_generated.deepcopy.go
index cfd666d22..5b2b871cd 100644
--- a/operator/v1/zz_generated.deepcopy.go
+++ b/operator/v1/zz_generated.deepcopy.go
@@ -316,7 +316,7 @@ func (in *KlusterletSpec) DeepCopyInto(out *KlusterletSpec) {
 	}
 	if in.WorkConfiguration != nil {
 		in, out := &in.WorkConfiguration, &out.WorkConfiguration
-		*out = new(WorkConfiguration)
+		*out = new(KlusterletWorkConfiguration)
 		(*in).DeepCopyInto(*out)
 	}
 	if in.HubApiServerHostAlias != nil {
@@ -370,6 +370,32 @@ func (in *KlusterletStatus) DeepCopy() *KlusterletStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KlusterletWorkConfiguration) DeepCopyInto(out *KlusterletWorkConfiguration) {
+	*out = *in
+	if in.ClusterRoles != nil {
+		in, out := &in.ClusterRoles, &out.ClusterRoles
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.FeatureGates != nil {
+		in, out := &in.FeatureGates, &out.FeatureGates
+		*out = make([]FeatureGate, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KlusterletWorkConfiguration.
+func (in *KlusterletWorkConfiguration) DeepCopy() *KlusterletWorkConfiguration {
+	if in == nil {
+		return nil
+	}
+	out := new(KlusterletWorkConfiguration)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *NodePlacement) DeepCopyInto(out *NodePlacement) {
 	*out = *in
diff --git a/operator/v1/zz_generated.swagger_doc_generated.go b/operator/v1/zz_generated.swagger_doc_generated.go
index 2f6d5271b..f8150555c 100644
--- a/operator/v1/zz_generated.swagger_doc_generated.go
+++ b/operator/v1/zz_generated.swagger_doc_generated.go
@@ -170,6 +170,16 @@ func (KlusterletStatus) SwaggerDoc() map[string]string {
 	return map_KlusterletStatus
 }
 
+var map_KlusterletWorkConfiguration = map[string]string{
+	"":             "KlusterletWorkConfiguration contains the configuration of work agent",
+	"clusterRoles": "ClusterRoles is the clusterroles that work agent binds to. If it is empty, the default admin clusterrole in kubernetes is bound to the work agent.",
+	"featureGates": "FeatureGates represents the list of feature gates for work agent If it is set empty, default feature gates will be used. If it is set, featuregate/Foo is an example of one item in FeatureGates:\n  1. If featuregate/Foo does not exist, registration-operator will discard it\n  2. If featuregate/Foo exists and is false by default. It is now possible to set featuregate/Foo=[false|true]\n  3. If featuregate/Foo exists and is true by default. If a cluster-admin upgrading from 1 to 2 wants to continue having featuregate/Foo=false,\n \the can set featuregate/Foo=false before upgrading. Let's say the cluster-admin wants featuregate/Foo=false.",
+}
+
+func (KlusterletWorkConfiguration) SwaggerDoc() map[string]string {
+	return map_KlusterletWorkConfiguration
+}
+
 var map_NodePlacement = map[string]string{
 	"":             "NodePlacement describes node scheduling configuration for the pods.",
 	"nodeSelector": "NodeSelector defines which Nodes the Pods are scheduled on. The default is an empty list.",