Chart RBAC for Capacity: cloud tiers read Karpenter; EKS Auto NodeClasses covered

[nadaverell]

The Capacity view gates per-CALLER: the page on `list nodes`, the Karpenter screens on `list nodepools`. The radar ServiceAccount already collects everything (`rbac.crdGroups.karpenter` defaults on), but in Cloud mode the caller is the hub user under the `radar:{viewer,member,owner}` tier bindings — and the cluster-read add-on granted nodes without Karpenter, so every Cloud tier would land in the denied-NodePools shape on Karpenter clusters. No new flag: every permission Capacity needs already has a home in the existing model.

What changed (in `deploy/helm/radar` — the chart's source of truth; releases sync it wholesale to skyhook-io/helm-charts)

• `cloud-rbac-cluster-read.yaml`: the tier add-on gains group-wide read on `karpenter.sh` + the provider NodeClass groups, gated on `rbac.crdGroups.karpenter` (caller read is meaningless for data the SA never caches — same rationale as the existing metrics gate). Group-wide rather than named kinds because Karpenter's kind set moves with its versions, and a named list would strand new kinds in an unexplainable denied state.
• `eks.amazonaws.com` joins the karpenter group list in both the SA ClusterRole and the new tier rule — EKS Auto Mode's NodeClasses live there; without it, Auto Mode clusters lose NodeClass readiness (the cascade attribution) and the Inspect link.
• README + values comment updated to match.

Landing this here rather than in helm-charts means the grants ship with exactly the release whose binary needs them (v1.9.0), and the release pipeline's `rm -rf && cp` sync can't erase them. Supersedes skyhook-io/helm-charts#35, closed for that reason.

Verification

`helm lint` clean. Rendered permutations: default → SA rule carries the widened group list; cloud mode → the `-cluster-read` role carries the karpenter rule bound to all three tiers; `rbac.crdGroups.karpenter=false` → both rules drop together.

---

Note

Low Risk
Read-only RBAC widening for provisioning config CRDs, gated on an existing flag; no secrets or write verbs.

Overview
Fixes Radar Cloud Capacity/Karpenter UX where hub users under radar:{viewer,member,owner} could list nodes but were denied on NodePools because the cluster-read add-on never included Karpenter.

cloud-rbac-cluster-read.yaml adds group-wide get/list/watch on Karpenter provider groups when rbac.crdGroups.karpenter is enabled, matching the SA cache gate used for metrics.

eks.amazonaws.com is added alongside the existing Karpenter groups in the SA ClusterRole, the new tier rule, README, and values comments so EKS Auto Mode NodeClasses (and related readiness/Inspect behavior) are covered.

Setting rbac.crdGroups.karpenter=false drops both the SA and tier Karpenter rules together.

^{Reviewed by Cursor Bugbot for commit a11e517. Bugbot is set up for automated code reviews on this repo. Configure here.}