feat(runner): add WithCacheByObject for per-object cache namespace scoping

cmd/runner/runner.go

@@ -94,6 +94,7 @@ type Runner struct {
 
 	customCollectors  []prometheus.Collector
 	customControllers []func(client.Client, *ctrlbuilder.Builder) error
+	cacheByObject     map[client.Object]cache.ByObject
 	processor         datasource.DatalayerProcessor
 }
 
@@ -119,6 +120,31 @@ func (r *Runner) WithCustomControllers(setupFuncs ...func(client.Client, *ctrlbu
 	return r
 }
 
+// WithCacheByObject configures per-object cache namespace scoping on the
+// controller-runtime manager. Entries override DefaultNamespaces (set via
+// the NAMESPACE env var) for the specified object types, allowing some
+// informers to be scoped to specific namespaces while others remain
+// cluster-wide.
+//
+// This is useful for RBAC hardening: scope a Secret informer to model
+// namespaces so the ServiceAccount only needs namespace-scoped
+// RoleBindings instead of cluster-wide secrets access.
+//
+// Example:
+//
+//	runner.NewRunner().
+//	    WithCacheByObject(map[client.Object]cache.ByObject{
+//	        &corev1.Secret{}: {
+//	            Namespaces: map[string]cache.Config{
+//	                "model-namespace": {},
+//	            },
+//	        },
+//	    })
+func (r *Runner) WithCacheByObject(byObject map[client.Object]cache.ByObject) *Runner {
+	r.cacheByObject = byObject
+	return r
+}
+
 func (r *Runner) Run(ctx context.Context) error {
 	// Setup a basic logger in case command-line argument parsing fails.
 	logutil.InitSetupLogging()
@@ -188,6 +214,9 @@ func (r *Runner) Run(ctx context.Context) error {
 			namespace: {},
 		}
 	}
+	if r.cacheByObject != nil {
+		cacheOptions.ByObject = r.cacheByObject
+	}
 
 	mgr, err := ctrl.NewManager(cfg, ctrl.Options{Cache: cacheOptions, Metrics: metricsServerOptions})
 	if err != nil {

cmd/runner/runner_test.go

@@ -0,0 +1,52 @@
+/*
+Copyright 2026 The llm-d Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runner
+
+import (
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+func TestWithCacheByObject(t *testing.T) {
+	byObject := map[client.Object]cache.ByObject{
+		&corev1.Secret{}: {
+			Namespaces: map[string]cache.Config{
+				"model-ns": {},
+			},
+		},
+	}
+
+	r := NewRunner().WithCacheByObject(byObject)
+
+	if r.cacheByObject == nil {
+		t.Fatal("expected cacheByObject to be set")
+	}
+	if len(r.cacheByObject) != 1 {
+		t.Fatalf("expected 1 entry in cacheByObject, got %d", len(r.cacheByObject))
+	}
+}
+
+func TestWithCacheByObjectNil(t *testing.T) {
+	r := NewRunner()
+
+	if r.cacheByObject != nil {
+		t.Fatal("expected cacheByObject to be nil by default")
+	}
+}