fix(chart): gate main ClusterRole rules by engine and provider

[teerthsharma]

Description

Closes #386.

The main Topograph API server ClusterRole was rendering the same broad Kubernetes RBAC rules regardless of the selected engine or provider. For non-Kubernetes combos (e.g. provider: test with engine: slurm) this granted unnecessary
odes, pods, and daemonsets access to a component that never talks to the Kubernetes API.

Changes

• Gate the main ClusterRole rules by engine/provider:

odes only for k8s, slinky,
fd engines and dra/infiniband-k8s providers.

odes update for k8s engine;
odes patch for slinky engine.

• pods only for slinky engine and infiniband-k8s provider.
• daemonsets only for infiniband-k8s provider.
• configmaps only for slinky engine.
• pods/exec logic is unchanged.
• Omit the main ClusterRole and ClusterRoleBinding entirely when no gated rules apply.
• Add charts/topograph/tests/rbac_test.yaml cases covering every engine/provider combo.
• Update umbrella snapshots and CHANGELOG.md.

Validation

• helm lint charts/topograph: pass
• helm unittest charts/topograph: 118 tests passed, 145 snapshots passed

Checklist

• I am familiar with the Contributing Guidelines.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.
• All commits are signed off per DCO (git commit -s).

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[greptile-apps]

Greptile Summary

This PR narrows the main API-server RBAC resources according to Helm-selected engine and provider combinations.

• Adds per-resource gates for node, pod, pod-exec, daemonset, and ConfigMap permissions.
• Omits the main ClusterRole and ClusterRoleBinding when no gate applies.
• Expands Helm unit coverage for engine/provider combinations and updates snapshots and the changelog.

Confidence Score: 3/5

This PR should not merge until RBAC is aligned with every engine and provider that the deployed server can select at request time.

A chart installed with a non-Kubernetes combination can omit the main role even though the API server still accepts requests that dispatch to Kubernetes-backed implementations, causing their API calls to be denied.

Files Needing Attention: charts/topograph/templates/rbac.yaml, charts/topograph/tests/rbac_test.yaml

Security Review

The new least-privilege gates do not account for request-time engine and provider selection, allowing the deployed authorization policy to diverge from the Kubernetes operations the API server executes.

Important Files Changed

Filename	Overview
charts/topograph/templates/rbac.yaml	Adds granular RBAC gates, but bases them on Helm values while runtime requests can select a different engine or provider.
charts/topograph/tests/rbac_test.yaml	Extensively covers static Helm value combinations but does not cover the deployment's request-time selection model.
charts/topograph/tests/snapshot/render_snapshot_test.yaml.snap	Updates rendered snapshots to reflect the narrower default RBAC output.
CHANGELOG.md	Documents the new engine/provider-based RBAC behavior.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  H[Helm engine/provider values] --> G[RBAC gates]
  G --> R[Rendered or omitted ClusterRole]
  Q[Request engine/provider] --> S[API server dispatch]
  S --> K[Kubernetes-backed engine/provider]
  R -. authorization may not match .-> K

Loading

_{Reviews (1): Last reviewed commit: "fix(chart): gate main ClusterRole by eng..." | Re-trigger Greptile}

[greptile-apps]

Request-time RBAC selection mismatch

When the chart is installed with a combination requiring no Kubernetes permissions, such as slurm with test, this condition omits the main role and binding even though requests can select a Kubernetes-backed engine or provider at runtime, causing those requests to fail with Kubernetes Forbidden errors. How this was verified: Request payloads can override engine and provider selection, while the chart's server ConfigMap does not constrain them to the Helm values used by these gates.