From 6bde6358ff21f55f18f9f327aa14b3965fb2bd84 Mon Sep 17 00:00:00 2001
From: Avinash Kumar Deepak <avinash8655279@gmail.com>
Date: Thu, 9 Jul 2026 16:17:42 +0530
Subject: [PATCH] chart: enable workloadmanager auth

Signed-off-by: Avinash Kumar Deepak <avinash8655279@gmail.com>
---
 manifests/charts/base/templates/rbac-router.yaml     | 8 ++++++++
 manifests/charts/base/templates/workloadmanager.yaml | 3 +++
 manifests/charts/base/values.yaml                    | 2 ++
 3 files changed, 13 insertions(+)

diff --git a/manifests/charts/base/templates/rbac-router.yaml b/manifests/charts/base/templates/rbac-router.yaml
index 4f3ecc06c..db061fcb0 100644
--- a/manifests/charts/base/templates/rbac-router.yaml
+++ b/manifests/charts/base/templates/rbac-router.yaml
@@ -13,6 +13,14 @@ rules:
   - apiGroups: [""]
     resources: ["secrets"]
     verbs: ["get", "create"]
+  {{- if .Values.workloadmanager.auth.enabled }}
+  - apiGroups: ["agents.x-k8s.io"]
+    resources: ["sandboxes"]
+    verbs: ["create", "delete"]
+  - apiGroups: ["extensions.agents.x-k8s.io"]
+    resources: ["sandboxclaims"]
+    verbs: ["create", "delete"]
+  {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
diff --git a/manifests/charts/base/templates/workloadmanager.yaml b/manifests/charts/base/templates/workloadmanager.yaml
index 0cf9264b6..1d7978084 100644
--- a/manifests/charts/base/templates/workloadmanager.yaml
+++ b/manifests/charts/base/templates/workloadmanager.yaml
@@ -79,6 +79,9 @@ spec:
           args:
             - --port={{ .Values.workloadmanager.service.port }}
             - --runtime-class-name=
+            {{- if .Values.workloadmanager.auth.enabled }}
+            - --enable-auth
+            {{- end }}
             {{- if .Values.spire.enabled }}
             - --tls-cert={{ .Values.spire.spiffeHelper.certDir }}/{{ .Values.spire.spiffeHelper.certFileName }}
             - --tls-key={{ .Values.spire.spiffeHelper.certDir }}/{{ .Values.spire.spiffeHelper.keyFileName }}
diff --git a/manifests/charts/base/values.yaml b/manifests/charts/base/values.yaml
index 1a454e9bb..e186b89d5 100644
--- a/manifests/charts/base/values.yaml
+++ b/manifests/charts/base/values.yaml
@@ -49,6 +49,8 @@ router:
 # AgentCube Workload Manager
 workloadmanager:
   replicas: 1
+  auth:
+    enabled: true
   image:
     repository: ghcr.io/volcano-sh/workloadmanager
     pullPolicy: IfNotPresent