fix(deploy): add missing configmaps RBAC and replace dead gcr.io kube…

[Shreesha001]

Description

Two issues block the documented local development flow (make deploy per developer_guide.md):

1. Missing ConfigMap RBAC: the controller ClusterRole grants no configmaps access, but the Project reconciler reads the namespace-labels-config ConfigMap (via the cached client, which starts a cluster-wide ConfigMap informer) as its first step and aborts on failure. Result: project namespaces are never created and the manager logs fill with configmaps is forbidden watch errors. Added a kubebuilder RBAC marker for configmaps (get/list/watch) and regenerated config/rbac/role.yaml.

2. Dead kube-rbac-proxy image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0 no longer exists (the GCR registry was shut down), so the manager pod stays in ImagePullBackOff. Switched to the image's current home, quay.io/brancz/kube-rbac-proxy:v0.8.0.

How Has This Been Tested?

Verified in a local Kind cluster deployed with make deploy:

• Without the RBAC rule: created a Project → its namespace is never created; configmaps is forbidden errors loop in the manager log.
• Re-added only the RBAC rule (same pod, no restart) → pending Project reconciled and the namespace was created within seconds, confirming the missing permission is the cause.
• With the quay.io image, the pod reaches 2/2 Running (previously ErrImagePull on the gcr.io image).

Checklist

• The title of the PR states what changed and the related issues number.
• Does this PR require documentation updates? — No
• I have performed a self-review of my own code.
• I have tested it (see above).
• Unit tests — N/A (RBAC marker + deploy manifest only, no code paths changed)

Does this PR introduce a breaking change for other components like worker-operator?

No

[Copilot]

Pull request overview

Fixes make deploy local development flow by addressing missing RBAC for ConfigMaps used early in Project reconciliation, and updating the kube-rbac-proxy image reference to a non-deprecated registry so the manager pod can start successfully.

Changes:

• Add kubebuilder RBAC marker granting configmaps get/list/watch to the controller.
• Regenerate/update config/rbac/role.yaml to include the ConfigMap rule in the controller ClusterRole.
• Replace dead gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0 image reference with quay.io/brancz/kube-rbac-proxy:v0.8.0.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
main.go	Adds kubebuilder RBAC marker for ConfigMaps to unblock Project reconciliation.
config/rbac/role.yaml	Adds generated ClusterRole rule allowing get/list/watch on ConfigMaps.
config/default/manager_auth_proxy_patch.yaml	Updates kube-rbac-proxy image to Quay to avoid ImagePullBackOff.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.