charts: omit namespace from KueueViz cluster RBAC

[lokesh0186]

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

KueueViz currently emits metadata.namespace on its ClusterRole and
ClusterRoleBinding even though both are cluster-scoped resources. Kubernetes
normalizes away namespace metadata for cluster-scoped resources before object
validation, so this is a manifest cleanup rather than an API rejection bug.

This change keeps the rendered RBAC manifests aligned with their resource scope
while preserving namespace where it is valid, including the ServiceAccount
subject and namespaced Role/RoleBinding resources.

Regression coverage uses a non-default Helm release namespace to verify that it
does not leak into cluster-scoped RBAC.

I independently reproduced the redundant rendered namespace metadata with
IaC-Guard-V 0.1.0a6; the supporting reproduction is available at:
https://github.com/lokesh0186/iac-guard-v/tree/4a55d51d852e36a5b64a7ee08e16254b7728078b/examples/public-reproductions/kueue-cluster-rbac-namespace

The immutable reproduction preserves the original direct-object-validation
interpretation. The corrected characterization here reflects the complete
kube-apiserver create path, which clears namespace metadata for cluster-scoped
resources before validation.

AI tools were used to assist with investigation and patch preparation. I reviewed
the resulting changes and validated them with the project's native test suite.

Which issue(s) this PR fixes:

NONE

Special notes for your reviewer:

Validation performed:

• Helm unit tests: 79/79 passed.
• helm lint charts/kueue: passed.
• The Helm rendering matrix from helm-verify: passed.
• The pinned YAML processing plan reproduced the generated chart changes exactly.
• kubectl kustomize config/kueueviz: passed.
• The rendered before/after diff contains only the two redundant top-level
  namespace removals.

Does this PR introduce a user-facing change?

NONE

Summary by CodeRabbit

• Maintenance

  • Removed redundant namespace metadata from KueueViz cluster-scoped RBAC resources.
  • Preserved the service account's namespace assignment for proper access control.

• Tests

  • Added coverage validating namespace behavior for KueueViz and manager RBAC resources.

[netlify]

✅ Deploy Preview for kubernetes-sigs-kueue ready!

Name	Link
🔨 Latest commit	eb804ec
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-sigs-kueue/deploys/6a8ee78f7417e60008d7b772
😎 Deploy Preview	https://deploy-preview-14816--kubernetes-sigs-kueue.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: lokesh0186 / name: Lokesh Chauhan (eb804ec)

[kubernetes-prow]

Welcome @lokesh0186!

It looks like this is your first PR to kubernetes-sigs/kueue 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/kueue has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[kubernetes-prow]

Hi @lokesh0186. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4bd405b6-b44b-43bc-baf2-4e4cf62e4db8

📥 Commits

Reviewing files that changed from the base of the PR and between 3ed4e2a and eb804ec.

📒 Files selected for processing (5)

• charts/kueue/templates/kueueviz/cluster-role-binding.yaml
• charts/kueue/templates/kueueviz/clusterrole.yaml
• charts/kueue/tests/rbac_namespace_scope_test.yaml
• config/components/kueueviz/cluster-role-binding.yaml
• config/components/kueueviz/clusterrole.yaml

💤 Files with no reviewable changes (4)

• charts/kueue/templates/kueueviz/clusterrole.yaml
• config/components/kueueviz/clusterrole.yaml
• config/components/kueueviz/cluster-role-binding.yaml
• charts/kueue/templates/kueueviz/cluster-role-binding.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The change removes invalid namespace metadata from KueueViz cluster-scoped RBAC resources and adds Helm tests for cluster-scoped and namespaced resource behavior.

Changes

RBAC namespace scope

Layer / File(s)	Summary
KueueViz RBAC scope and validation charts/kueue/templates/kueueviz/*, config/components/kueueviz/*, charts/kueue/tests/rbac_namespace_scope_test.yaml	KueueViz ClusterRole and ClusterRoleBinding resources omit metadata.namespace. The binding subject uses the Helm release namespace. Manager secrets Role and RoleBinding retain their namespace. Helm tests verify these rendered values.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to eb804

The KueueViz manifests now omit invalid namespace metadata from cluster-scoped RBAC resources while retaining namespace on valid namespaced resources. The localized change is covered by regression tests and validation, so no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing namespace metadata from KueueViz cluster-scoped RBAC resources in the charts.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[tenzen-y]

/ok-to-test

[tenzen-y]

Kubernetes
object metadata validation rejects namespace on non-namespaced resources.

This is not right. Even if you specify namespace for cluster roles, kubernetes doesn't reject it.
So, I think this is not bug.

[tenzen-y]

/remove-kind bug
/kind cleanup

[tenzen-y]

/release-note-edit

NONE

[tenzen-y]

But, we can backport this PR as same as previous Helm chart cleanup PRs regardless of PR kind.

[tenzen-y]

/lgtm
/approve

[kubernetes-prow]

LGTM label has been added.

Details

Git tree hash: 3e5a3ba74c9d6252a6fde75e72fcfe29c65ccc82

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lokesh0186, tenzen-y

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [tenzen-y]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tenzen-y]

/cherrypick release-0.18
/cherrypick release-0.19

[k8s-infra-cherrypick-robot]

@tenzen-y: once the present PR merges, I will cherry-pick it on top of release-0.18, release-0.19 in new PRs and assign them to you.

Details

In response to this:

/cherrypick release-0.18
/cherrypick release-0.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[lokesh0186]

Thanks for the correction, you're right. I was validating the RBAC object directly and missed the kube-apiserver namespace normalization that occurs before validation. I've corrected the description. Thanks for reviewing and for the backport guidance.

[k8s-infra-cherrypick-robot]

@tenzen-y: new pull request created: #14824

Details

In response to this:

/cherrypick release-0.18
/cherrypick release-0.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-infra-cherrypick-robot]

@tenzen-y: new pull request created: #14825

Details

In response to this:

/cherrypick release-0.18
/cherrypick release-0.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.