Helm: Support optional namespaced RBAC as alternative to cluster-scoped #1546

Summary

Currently, the kagent Helm chart always creates cluster-scoped RBAC resources (ClusterRole / ClusterRoleBinding) for the controller. In environments where cluster-wide permissions are restricted (e.g., multi-tenant clusters, security-constrained namespaces), users should be able to opt into namespaced RBAC (Role / RoleBinding) instead.

Current Behavior

• getter-role and writer-role are rendered as ClusterRoles unconditionally
• Corresponding ClusterRoleBindings bind them to the controller ServiceAccount
• There are no Helm values to toggle or customize RBAC scope
• The only namespaced RBAC is the leader-election Role (conditional on replicas > 1)
• Agent-specific charts (istio-agent, argo-rollouts-agent, cilium-*-agent, etc.) also use ClusterRoles with no namespace-scoped alternative

Proposed Behavior

Add a Helm value (e.g., rbac.clusterScoped: true defaulting to current behavior) that, when set to false:

1. Controller RBAC: Renders Role / RoleBinding scoped to the release namespace (or a configurable list of namespaces) instead of ClusterRole / ClusterRoleBinding
2. Agent RBAC: Similarly scopes agent-specific roles to the target namespace(s)
3. CRD access: Documents any limitations — e.g., CRD watches are inherently cluster-scoped, so namespaced mode may require additional considerations for how the controller discovers resources

Suggested values.yaml shape

rbac:
  # Create RBAC resources
  create: true
  # Use ClusterRole/ClusterRoleBinding (true) or Role/RoleBinding (false)
  clusterScoped: true
  # When clusterScoped is false, which namespaces to create Roles in
  # Defaults to the release namespace if empty
  namespaces: []

Motivation

• Multi-tenant clusters: Namespace admins often cannot create ClusterRoles
• Least-privilege: Users running kagent for a single namespace don't need cluster-wide access
• Security policies: Some orgs enforce OPA/Kyverno policies that block ClusterRole creation

Additional Context

Files affected:

• helm/kagent/templates/rbac/getter-role.yaml
• helm/kagent/templates/rbac/writer-role.yaml
• helm/kagent/templates/rbac/getter-rolebinding.yaml
• helm/kagent/templates/rbac/writer-rolebinding.yaml
• helm/kagent/values.yaml
• Agent chart RBAC templates (e.g., helm/agents/istio-agent/templates/rbac.yaml)
• helm/kagent/tests/rbac_test.yaml (update tests)

Comment left by Claude on behalf of @EItanya.