[HsiuChuanHsu]

What type of PR is this?

/kind bug

What this PR does / why we need it?

AppWrapper is the only CRD integration without editor and viewer ClusterRoles. This PR adds appwrapper_editor_role.yaml and appwrapper_viewer_role.yaml, modeled on the SparkApplication roles,

Also updates rbac.md so it lists what the batch-admin and batch-user roles actually cover.

Fixes #

Useful notes for your reviewer

Release note

AppWrapper: Added editor and viewer ClusterRoles for AppWrappers

AI summary

Added AppWrapper editor and viewer ClusterRoles to the Kueue RBAC manifests and Helm chart. The editor role can manage AppWrappers; the viewer role can read them. Updated the RBAC documentation to describe the resources covered by the batch-admin and batch-user roles.

Suggested release note

RBAC: Add editor and viewer roles for AppWrappers.

[netlify]

✅ Deploy Preview for kubernetes-sigs-kueue ready!

Name	Link
🔨 Latest commit	26fac5d
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-sigs-kueue/deploys/6ab49bf07a16c8000808b071
😎 Deploy Preview	https://deploy-preview-16096--kubernetes-sigs-kueue.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[kubernetes-prow]

Hi @HsiuChuanHsu. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: kubernetes-sigs/kueue/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 299534d4-c562-4c74-b17a-70eef59d336c

📥 Commits

Reviewing files that changed from the base of the PR and between 7752c23 and 26fac5d.

📒 Files selected for processing (6)

• charts/kueue/templates/rbac/appwrapper_editor_role.yaml
• charts/kueue/templates/rbac/appwrapper_viewer_role.yaml
• config/components/rbac/appwrapper_editor_role.yaml
• config/components/rbac/appwrapper_viewer_role.yaml
• config/components/rbac/kustomization.yaml
• site/content/en/docs/tasks/manage/rbac.md

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds AppWrapper editor and viewer ClusterRoles to the Helm chart and component manifests. It registers the component manifests and updates documentation describing the batch admin and user roles.

Changes

AppWrapper RBAC

Layer / File(s)	Summary
Define AppWrapper access roles config/components/rbac/appwrapper_editor_role.yaml, config/components/rbac/appwrapper_viewer_role.yaml, charts/kueue/templates/rbac/appwrapper_editor_role.yaml, charts/kueue/templates/rbac/appwrapper_viewer_role.yaml	Adds editor permissions, including lifecycle verbs and status access, and viewer permissions for reading AppWrappers and their status.
Register roles and update role descriptions config/components/rbac/kustomization.yaml, site/content/en/docs/tasks/manage/rbac.md	Adds the component role manifests to the kustomization resources and updates descriptions of the batch admin and user roles.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 26fac

The AppWrapper roles appear ready to merge after normal checks; no concrete issue requiring a fix was identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding editor and viewer ClusterRoles for AppWrapper RBAC.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[tenzen-y]

/ok-to-test

[tenzen-y]

Thank you
/lgtm
/approve

[kubernetes-prow]

LGTM label has been added.

Details

Git tree hash: 73f11c677defa58d11e95c02464a87e93e94055e

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: HsiuChuanHsu, tenzen-y

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [tenzen-y]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tenzen-y]

/cherrypick release-0.18
/cherrypick release-0.19
/cherrypick website

[k8s-infra-cherrypick-robot]

@tenzen-y: once the present PR merges, I will cherry-pick it on top of release-0.18, release-0.19, website in new PRs and assign them to you.

Details

In response to this:

/cherrypick release-0.18
/cherrypick release-0.19
/cherrypick website

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-infra-cherrypick-robot]

@tenzen-y: new pull request created: #16099

Details

In response to this:

/cherrypick release-0.18
/cherrypick release-0.19
/cherrypick website

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-infra-cherrypick-robot]

@tenzen-y: new pull request created: #16100

Details

In response to this:

/cherrypick release-0.18
/cherrypick release-0.19
/cherrypick website

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-infra-cherrypick-robot]

@tenzen-y: new pull request created: #16101

Details

In response to this:

/cherrypick release-0.18
/cherrypick release-0.19
/cherrypick website

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.