fix(podgrouper): skip WorkloadRunner wrapper when selecting the grouping plugin (v0.16 backport)

[gshaibi]

Description

Manual backport of #2067 to v0.16. The automated backport failed to cherry-pick; v0.17 succeeded as #2070.

Conflicts resolved — v0.16 predates the Karta fallback hub, so the incoming changes had to be adapted:

• hub.go struct field is defaultPlugin, not defaultGroupingHandler.
• Dropped the kartaFallbackPlugin assignment and the run.ai/kartas RBAC marker; neither exists on this branch.
• hub_test.go: dropped the "Generic Karta Fallback Tests" context and the runtime/types/ptr imports it needed. Kept the new "Skip Top Owner Resolution Tests" case and adjusted it to v0.16's 7-argument NewDefaultPluginsHub (no genericKartaFallback).
• Per §3.2 of the original, the resolver change here stays wildcard-only — there is no Karta hub to delegate to.

Second commit is required, not optional

v0.16 registers the DGD at exact v1alpha1; main/v0.17 already use Version: "*" (widened by #1870, which shipped in v0.17.0 and so is absent here).

This matters because the backport also grants podgrouper read access on dynamographdeployments. Today that read 403s, and handleGetOwnerError truncates the chain to PodCliqueSet — the Grove grouper runs and grouping is accidentally correct. Once the grant lands, the walk climbs past the DGD to the WorkloadRunner, skips back down, and asks the table for nvidia.com/v1beta1/DynamoGraphDeployment. On an unwidened v0.16 that misses, falls to the default grouper, and produces the flat minMember: 1 this PR is meant to fix — for anyone on Dynamo ≥1.2.0.

So cherry-pick alone would regress v1beta1 users. The two commits must land together.

Related Issues

Backport of #2067. Related to #856.

Checklist

• Self-reviewed
• Added/updated tests (if needed)
• Updated documentation (if needed)
• Added a changelog fragment via make changelog (or applied the skip-changelog label). Do not edit CHANGELOG.md directly — pending fragments are folded into it at release time.

Breaking Changes

None beyond #2067. Note the behavior change is intentional and coupled to the new RBAC: clusters that were previously grouping correctly because the DGD read was denied will now walk the full chain. That is the point of the fix, and it is why both commits ship together.

Additional Notes

Verified on this branch: go build ./pkg/podgrouper/... clean, full ./pkg/podgrouper/... suite passes, gofmt clean, and make manifests reproduces the cherry-picked podgrouper.yaml with no drift (workloadrunners and dynamographdeployments both present).

The changelog fragment came across with the cherry-pick. I did not add a second one for the widening: v0.16's make changelog target is changie new with no KIND/BODY support, so it cannot be driven non-interactively here, and hand-writing fragments is against the contributor guide. Happy to add one if a maintainer runs it interactively.

Consumers to update after this merges: runai-engine pins KAI as a submodule (v3.41 → v0.16.3) and hand-maintains its own podgrouper ClusterRole, so the workloadrunners and dynamographdeployments grants do not propagate from the kubebuilder markers here — they need a separate engine-side change, shipped in the same release as the submodule bump.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 32349c5e-1431-4fb3-afae-98e59ce90af7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[KaiPilotBot]

📝 Changelog fragment recorded

Thanks! This PR added the changelog fragment(s) below. Pending fragments are folded into CHANGELOG.md at release time, so it was intentionally not modified by this PR — your entry will appear in the next release:

• .changes/unreleased/fixed-20260812-141030.yaml