fix: prevent Namespace informer cache errors and fallbacks

[supreme-gg-gg]

Summary

In namespaced RBAC mode, any code path that read a Namespace object via the cached client would lazily start a cluster-scoped list/watch informer. Since a Role cannot grant access to cluster-scoped resources, this informer repeatedly fails with a 403 error. The simple repro is listing namespaces from the UI and the following will show up repeated in the controller logs:

failed to list *v1.Namespace: namespaces is forbidden: User \"system:serviceaccount:kagent:kagent-controller\" cannot list resource \"namespaces\" in API group \"\" at the cluster

This PR disables controller-runtime's informer cache for Namespace objects, which automatically uses direct API reads, and thus we have the ability to catch authorization errors and use a fallback and prevent the error loop. When available, we use watchedNamespaces as a fallback for isInternalK8sURL and /api/namespaces call sites. For AllowedNamespaces.from=Selector, it returns a clear error since reading namespace labels requires cluster role.

Testing

The following scenarios have been manually tested:

• Listing namespaces from the UI no longer causes UI and controller error
• The above informer error spam is no longer there
• Cross NS reference with AllowNamespaces.from=All, AllowedNamespaces.from=Selector (both allowed and rejected paths and unwatched namespace rejection)
• isInternalK8sURL will fallback to watchedNamespaces during agent translation

Alternatives

Other than catching the error, I've also thought of using some mechanism to "inform" the controller if it has cluster wide access or not. I considered watchedNamespaces (which is always set if using namespaced RBAC) or creating another flag, but eventually both has some complex logic or edge cases troubles and gracefully handling errors / fallback seems the best solution to me right now.

[Copilot]

Pull request overview

Disables controller-runtime’s cached client for Namespace objects to prevent cluster-scoped Namespace informer 403 loops in namespaced RBAC mode, and adds watched-namespace-based fallbacks where Namespace reads may be forbidden.

Changes:

• Configure manager client to bypass the informer cache for corev1.Namespace.
• Add watched-namespace fallback logic to namespace listing (/api/namespaces) and internal-K8s-URL detection.
• Improve behavior when AllowedNamespaces.from=Selector is used without Namespace read permissions (clear error) and add/extend related tests.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
go/core/pkg/app/app.go	Disables cached client for Namespace; passes watched namespaces into translator constructor.
go/core/internal/httpserver/handlers/namespaces.go	Adds Forbidden/Unauthorized fallback to configured watched namespaces; introduces helper for name-only responses.
go/core/internal/httpserver/handlers/handlers.go	Adds WatchedNamespaces onto handler base dependencies.
go/core/internal/httpserver/handlers/agents.go	Constructs translator with watched namespaces from handler base.
go/core/internal/httpserver/handlers/namespaces_test.go	Adds test covering fallback to watched namespaces when Namespace reads are forbidden.
go/core/internal/controller/translator/agent/adk_api_translator.go	Adds watched-namespace fallback in isInternalK8sURL; introduces new constructor variant.
go/core/internal/controller/translator/agent/proxy_test.go	Adds test ensuring proxy translation falls back to watched namespaces when Namespace reads are forbidden.
go/api/v1alpha2/common_types.go	Returns a clearer error when selector-based allowed namespaces can’t read namespace labels due to RBAC.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[EItanya]

Can this be optional based on the clusterRole setting? Otherwise caching this is definitely better