Capacity RBAC: cloud tiers read Karpenter; EKS Auto NodeClasses join the karpenter grant

[nadaverell]

Radar v1.9.0 ships the Capacity view, whose endpoints gate per-CALLER: the page on `list nodes`, the Karpenter screens on `list nodepools`. The radar ServiceAccount already collects everything (`rbac.crdGroups.karpenter` defaults on), but in Cloud mode the caller is the hub user under the `radar:{viewer,member,owner}` tier bindings — and the cluster-read add-on granted nodes without Karpenter, so every Cloud tier would land in the denied-NodePools shape on Karpenter clusters. No new flag: all the permissions Capacity needs already have homes in the existing model.

What changed

• `cloud-rbac-cluster-read.yaml`: the tier add-on gains group-wide read on `karpenter.sh` + the provider NodeClass groups, gated on `rbac.crdGroups.karpenter` (caller read is meaningless for data the SA never caches — same rationale as the existing metrics gate). Group-wide rather than named kinds because Karpenter's kind set moves with its versions (NodeOverlays, provider NodeClass variants) and a named list would strand new kinds in an unexplainable denied state. Same benign-infra class as the rest of the role: cluster-scoped provisioning config, no secrets.
• `eks.amazonaws.com` joins the karpenter group list in both the SA ClusterRole and the new tier rule — EKS Auto Mode's NodeClasses live there, and without it Auto Mode clusters lose NodeClass readiness (the cascade attribution) and the Inspect link while everything else works.
• README + values.yaml comments updated to match.

Verification

`helm lint` clean. Rendered permutations: default (non-cloud) → SA rule carries the widened group list; cloud mode → the `-cluster-read` role carries the karpenter rule bound to all three tiers; `rbac.crdGroups.karpenter=false` → both rules drop together.

Notes

Chart version bumped to 1.8.8 (CI requires a bump on any chart change); the v1.9.0 release automation supersedes it. Existing installs pick the new roles up on their next `helm upgrade`; an image-only upgrade path won't re-render RBAC, so clusters upgraded that way keep the caller-denied shape until their next chart-level upgrade — the in-product denied state names the missing grant either way.

---

Note

Medium Risk
Expands read-only cluster RBAC for Cloud users and the Radar SA on Karpenter/EKS provisioning APIs; changes are gated and non-secret but affect authorization for all Cloud tiers on Karpenter clusters.

Overview
Fixes Capacity / Karpenter visibility for Radar Cloud hub users by extending the existing cluster-read add-on ClusterRole: when rbac.crdGroups.karpenter is on, all radar:{viewer,member,owner} tiers get read-only access to Karpenter-related API groups (group-wide * resources), gated the same way as metrics so caller permissions only apply when the SA actually caches those CRDs.

eks.amazonaws.com is added alongside the existing Karpenter provider groups on both the ServiceAccount ClusterRole and the new Cloud tier rule so EKS Auto Mode NodeClasses are included without a separate flag.

Chart version bumps to 1.8.8; README and values.yaml comments match the widened group list. Existing clusters need a Helm upgrade to re-render RBAC (image-only upgrades won’t apply these rules).

^{Reviewed by Cursor Bugbot for commit 9b53e07. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9b53e07. Configure here.}

[cursor]

Wildcard exposes NodeDiagnostic credentials

High Severity

Group-wide resources: ["*"] on eks.amazonaws.com also covers NodeDiagnostic, whose spec.logCapture.destination can embed pre-signed S3 URLs with AWS credential material. With defaults on, every Cloud tier (including radar:viewer) and the SA gain get/list/watch on those objects, which conflicts with the role’s “no secrets” / benign-infra boundary aimed at NodeClasses.

Additional Locations (1)

• charts/radar/templates/clusterrole.yaml#L302-L305

 

^{Reviewed by Cursor Bugbot for commit 9b53e07. Configure here.}

[nadaverell]

Closing: the release pipeline syncs charts/radar wholesale from skyhook-io/radar's deploy/helm/radar (rm -rf && cp on every release), so changes here get erased at the next release. The identical change landed at the source of truth instead — see the radar PR referenced above — and will arrive in this repo with the v1.9.0 sync, alongside the binary that needs it.