Kueue: plugin blocks non-admins from viewing namespaced Workloads/LocalQueues

[harsh-aghara]

Describe the bug

The Kueue plugin prevents non-admin users from being able to view namespaced resources (Workloads, LocalQueues) in the UI, even though they do have the appropriate RBAC permissions to get and list those resources in their namespace.

Expected outcome:
Users who have RBAC permissions on a namespace should be able to view the lists of Workloads and LocalQueues, and Headlamp should automatically filter and show the resources for the namespaces to which they have access.

To Reproduce

Steps to reproduce the bug:

1. Make a namespace and a service account, for example, data-scientist in the data-sci namespace.
2. Make a Role that gives get, list, and watch permissions on workloads.kueue.x-k8s.io and localqueues.kueue.x-k8s.io.
3. Use a namespace-scoped RoleBinding in the data-sci namespace to bind the Role to the service account.
4. Log in to Headlamp using a token that has been generated for the data-scientist service account.
5. In the left sidebar, click on Kueue.
6. Click on the tab labelled Workloads.
7. Look at the error message: "The Kubernetes credentials you currently have are not authorized to list this page."

Environment (please provide info about your environment):

• Installation type: Linux Desktop App(using flatpak)
• Headlamp Version: latest main
  Other: Kueue Plugin (version 0.1.0-alpha)

Can you fix this issue?

I'll submit a pull request to fix this bug.

Screenshots:

[Ralthos]

Traced the mechanism. KueueAdminResourceAccess runs a cluster-scoped check:

<AuthVisible item={resourceClass} authVerb={verb} onAuthResult={...}>

No namespace is passed, so the SelfSubjectAccessReview asks whether the user can list the
resource cluster-wide. A namespace-scoped RoleBinding fails that, and the page is replaced by
the denial message before any list request happens.

Right for two of the four resources, wrong for the other two:

clusterQueue.ts     isNamespaced = false
resourceFlavor.ts   isNamespaced = false
localQueue.ts       isNamespaced = true
workload.ts         isNamespaced = true

Both List and Detail under localqueues/ and workloads/ wrap in it.

Detail has a clean fix. AuthVisible takes a namespace prop and forwards it to
getAuthorization, and the route is /kueue/workloads/:namespace/:name, so useParams already
holds the namespace.

List is the open question, with no single namespace to check. Letting it render and return what
the user can read matches how Headlamp treats namespaced lists elsewhere, but that is a
behaviour decision and probably a maintainer's call.

The denial text also says "Kueue Workloads are cluster-scoped admin resources", which is not true
of Workloads or LocalQueues.

Happy to pick this up if nobody has started.

[Ralthos]

Correcting my last point: the denial text is fine. All four namespaced call sites already pass
an accurate accessDescription, "namespaced user workload resources" and "namespaced user queue
resources". The cluster-scoped admin resources default only applies to clusterqueues/ and
resourceflavors/, where it is true. I read the default in the component and did not check the
call sites.

The rest holds. The cluster-scoped AuthVisible check is still what denies the page.