feat(helm): support namespaced RBAC in charts

[supreme-gg-gg]

Close #1546

• Adds a helm value to configure whether to use cluster scoped or namespaced RBAC for getter and writer roles
• Render controller roles to Role/RoleBinding or ClusterRole/ClusterRoleBinding conditionally
• Updated helm unit tests, tested manually by impersonating the service accounts
• Limitation: When controller is not using cluster scoped role, either manually set controller.watchNamespaces or it is defaulted to the namespace accessible by the role.

[Copilot]

Pull request overview

Adds an opt-in Helm configuration to render RBAC as either cluster-scoped (ClusterRole/ClusterRoleBinding) or namespaced (Role/RoleBinding), intended to support restricted environments while keeping current behavior as the default.

Changes:

• Introduces rbac.create, rbac.clusterScoped, and rbac.namespaces Helm values for RBAC scoping control.
• Splits controller RBAC into dedicated getter/writer Role(+Binding) templates with conditional cluster vs namespace scope.
• Updates several agent subchart RBAC templates to conditionally render Role/RoleBinding vs ClusterRole/ClusterRoleBinding and expands Helm unit tests.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
helm/kagent/values.yaml	Adds RBAC configuration values to control scoping and optional namespaces.
helm/kagent/tests/rbac_test.yaml	Updates/extends Helm unit tests for the new RBAC templates and scoping modes.
helm/kagent/templates/rbac/getter-role.yaml	Refactors getter rules into a named template and conditionally renders ClusterRole vs Role.
helm/kagent/templates/rbac/getter-rolebinding.yaml	Conditionally renders ClusterRoleBinding vs RoleBinding (including multi-namespace support).
helm/kagent/templates/rbac/writer-role.yaml	New writer RBAC template with conditional ClusterRole vs Role rendering.
helm/kagent/templates/rbac/writer-rolebinding.yaml	New writer binding template with conditional ClusterRoleBinding vs RoleBinding rendering.
helm/agents/istio/templates/rbac.yaml	Adds conditional cluster-scoped vs namespaced RBAC (including multi-namespace support).
helm/agents/cilium-policy/templates/rbac.yaml	Adds conditional cluster-scoped vs namespaced RBAC (including multi-namespace support).
helm/agents/cilium-manager/templates/rbac.yaml	Adds conditional cluster-scoped vs namespaced RBAC (including multi-namespace support).
helm/agents/cilium-debug/templates/rbac.yaml	Adds conditional cluster-scoped vs namespaced RBAC (including multi-namespace support).
helm/agents/argo-rollouts/templates/rbac.yaml	Adds conditional cluster-scoped vs namespaced RBAC (including multi-namespace support).

Comments suppressed due to low confidence (3)

helm/kagent/templates/rbac/getter-role.yaml:102

• The included kagent.getter.rules template contains apiGroups: ["gateway.networking.k8s.io/v1"]. RBAC apiGroups must not include a version (and / is invalid), so the rendered (Cluster)Role will be rejected by the API server. Change it to gateway.networking.k8s.io (and keep v1 only in resource manifests).
  helm/kagent/templates/rbac/getter-rolebinding.yaml:18
• The controller ServiceAccount is created in {{ include "kagent.namespace" . }} (supports namespaceOverride), but this binding hard-codes the subject namespace to .Release.Namespace. When namespaceOverride is set, the RoleBinding/ClusterRoleBinding will point at a ServiceAccount in the wrong namespace and RBAC won’t work. Use include "kagent.namespace" for the subject namespace (and default the $namespaces list to that same namespace when rbac.namespaces is empty).
  helm/kagent/tests/rbac_test.yaml:123
• The namespaceOverride behavior is tested for ServiceAccounts, but there’s no assertion that the RBAC bindings’ subjects[0].namespace tracks the same overridden namespace. Since the RBAC templates currently reference .Release.Namespace, adding a unit test that sets namespaceOverride and asserts the rolebinding/clusterrolebinding subject namespace would prevent regressions here.

  - it: should use custom namespace when overridden
    set:
      namespaceOverride: "custom-namespace"
    templates:
      - controller-serviceaccount.yaml
      - ui-serviceaccount.yaml
    asserts:
      - equal:
          path: metadata.namespace
          value: custom-namespace

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[EItanya]

Awesome work here :)