chart: enable workloadmanager auth

[avinxshKD]

What type of PR is this?

/kind bug

What this PR does / why we need it:

Enables WorkloadManager auth in the base chart. The chart already has Router call WorkloadManager with its service account token, but WorkloadManager was not started with --enable-auth.

Also grants Router the minimal sandbox create/delete RBAC needed once WorkloadManager starts using the caller token.

Which issue(s) this PR fixes:
Fixes #432

Special notes for your reviewer:

Helm is not installed in my local env, so I could not run helm template or helm lint. I did run git diff --cached --check before committing.

Does this PR introduce a user-facing change?:

Base chart now enables WorkloadManager auth by default.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[volcano-sh-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hzxuzhonghu for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gemini-code-assist]

Code Review

This pull request introduces authentication configuration for the AgentCube Workload Manager, enabling the --enable-auth flag and setting up RBAC permissions for the router service account to manage sandboxes and sandboxclaims. The review feedback recommends replacing the proposed ClusterRole and ClusterRoleBinding with namespace-scoped Role and RoleBinding resources to adhere to the principle of least privilege and prevent naming conflicts in multi-namespace deployments.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[avinxshKD]

small chart-side fix for this. Found that just passing --enable-auth was not enough, since WorkloadManager uses the caller token after auth is enabled. Added the minimal fix

@acsoto @JesseStutler PTAL, when get chance.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.50%. Comparing base (524e55e) to head (6bde635).
⚠️ Report is 176 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #433       +/-   ##
===========================================
+ Coverage   47.57%   58.50%   +10.93%     
===========================================
  Files          30       36        +6     
  Lines        2819     3463      +644     
===========================================
+ Hits         1341     2026      +685     
+ Misses       1338     1228      -110     
- Partials      140      209       +69     

Flag	Coverage Δ
unittests	58.50% <ø> (+10.93%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.