Add cluster-reader wildcard read rule + Tenant-space common namespace fallback

[iamtrazy]

Summary

• Broaden cluster_reader role template with a wildcard read rule (/, get/list/watch) so cluster-reader tenants can view all resource types, not just nodes/nodemetrics.
• Fix tenant-space's active_net_ns_name resolution: replace coalesce() with an explicit null-check ternary so it correctly falls back to network_namespace when common_namespace is unset

Summary by CodeRabbit

• New Features

  • Expanded read-only access for cluster readers, allowing them to view resources across the Kubernetes API.

• Bug Fixes

  • Improved tenant network namespace selection when a common namespace is unavailable, ensuring the configured network namespace is used reliably.

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes broaden the cluster reader role’s Kubernetes read permissions and replace coalescing-based network namespace selection with an explicit null check.

Changes

Cluster reader access

Layer / File(s)	Summary
Wildcard cluster reader permissions modules/tenancy/cluster-roles/main.tf	Adds get, list, and watch permissions for all API groups and resources to the cluster reader role template.

Network namespace resolution

Layer / File(s)	Summary
Explicit namespace fallback modules/tenancy/tenant-space/main.tf	Selects local.common_namespace when it is non-null and otherwise falls back to local.network_namespace.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description includes only Summary and omits the required Changes, Testing, and Checklist sections.	Add the missing Changes, Testing, and Checklist sections, and note any validation results or issue links if applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes both the cluster-reader wildcard rule and the tenant-space namespace fallback.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@modules/tenancy/cluster-roles/main.tf`:
- Around line 606-610: Replace the wildcard rule in the cluster-reader role with
explicitly enumerated non-sensitive resources and API groups, excluding
core-group secrets; use the preceding rules and the template’s intended
visibility scope (nodes, events, metrics, machines) as the allowlist. Update the
rules block in the cluster role template and verify all resources needed by
bound readers remain covered.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4fef2e7c-d864-4166-97b1-722901c30472

📥 Commits

Reviewing files that changed from the base of the PR and between da34b3d and ffeaf4c.

📒 Files selected for processing (2)

• modules/tenancy/cluster-roles/main.tf
• modules/tenancy/tenant-space/main.tf