[jtatum]

In watchNamespaces mode, stubbi#618 places get namespaces in tenant Roles. Namespace objects are cluster-scoped, so those grants cannot authorize the Pod Security label lookup. The controller then retains the ownership helper default, potentially producing a pod rejected by restricted admission.

Move Namespace reads into the chart's existing cluster-scoped rule set and ClusterRoleBinding. In namespaced mode, constrain resourceNames to the configured watched namespaces. Cluster-wide mode permits reading any Namespace. Neither mode gains Namespace list/watch/write permissions.

This PR targets fix/data-owner-pss-aware as a focused follow-up to stubbi#618. It can be retargeted/rebased onto main after that PR merges. The separate namespace-lookup failure handling review on stubbi#618 remains relevant; this change fixes the chart permission grant.

Validation:

• A regression test renders the chart, applies its actual RBAC to a disposable envtest API server configured with RBAC, and checks authorization as the rendered operator ServiceAccount identity.
• The original fix: skip init-data-owner in namespaces enforcing restricted Pod Security stubbi/openclaw-operator#618 template fails the watched-Namespace read assertion. The fixed template permits the two watched namespaces, denies unwatched/operator namespaces, and denies Namespace list/watch/patch. Cluster-wide mode is checked too.
• Full make test, make lint, and both Helm RBAC guard scripts pass. CI installs Helm for the authorization test.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T03:59:33.198289Z	f1d69ff	PR opened
🔒 Security Review	✅ Completed 2026-10-04T04:00:47.890267Z	f1d69ff	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.