update AppWrapper RBACs for Kueue 0.10.0

Author: dgrove-oss

config/rbac/role.yaml

@@ -14,6 +14,14 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - ""
   resources:

pkg/controllers/appwrapper_controller.go

@@ -42,6 +42,9 @@ package controllers
 // +kubebuilder:rbac:groups=kueue.x-k8s.io,resources=resourceflavors,verbs=get;list;watch
 // +kubebuilder:rbac:groups=kueue.x-k8s.io,resources=workloadpriorityclasses,verbs=get;list;watch
 
+// permissions needed by Kueue's base webhook
+// +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list;watch
+
 // permission to watch nodes and edit clusterqueues for Autopilot integration
 //+kubebuilder:rbac:groups="",resources=nodes,verbs=get;list;watch
 //+kubebuilder:rbac:groups=kueue.x-k8s.io,resources=clusterqueues,verbs=get;list;watch;update;patch