fix: move provider-namespace RBAC to optional manifest

dashboard.yaml now only creates Role/RoleBinding in 'default' (always
exists). Provider namespaces (kaito-workspace, dynamo-system,
kuberay-system) are in a separate hf-secret-rbac.yaml applied after
provider installation. Fixes apply failure on clean clusters.

Also fix rollback command in versioning-upgrades.md to use correct
deployment name (kubeairunway-controller-manager).

Author: sozercan

deploy/kubernetes/dashboard.yaml

@@ -141,9 +141,12 @@ subjects:
     namespace: kubeairunway-system
 
 ---
-# Namespace-scoped Roles for HuggingFace token secret management.
+# Namespace-scoped Role for HuggingFace token secret management.
 # Scoped to resourceNames: ["hf-token-secret"] so the dashboard can only
-# delete this specific secret, not any other secret in these namespaces.
+# delete this specific secret, not any other secret in this namespace.
+#
+# For provider namespaces (kaito-workspace, dynamo-system, kuberay-system),
+# apply deploy/kubernetes/hf-secret-rbac.yaml after installing those providers.
 
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -158,48 +161,6 @@ rules:
   resourceNames: ["hf-token-secret"]
   verbs: ["delete"]
 
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: kubeairunway-hf-secret
-  namespace: kaito-workspace
-  labels:
-    app.kubernetes.io/name: kubeairunway
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  resourceNames: ["hf-token-secret"]
-  verbs: ["delete"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: kubeairunway-hf-secret
-  namespace: dynamo-system
-  labels:
-    app.kubernetes.io/name: kubeairunway
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  resourceNames: ["hf-token-secret"]
-  verbs: ["delete"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: kubeairunway-hf-secret
-  namespace: kuberay-system
-  labels:
-    app.kubernetes.io/name: kubeairunway
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  resourceNames: ["hf-token-secret"]
-  verbs: ["delete"]
-
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -217,57 +178,6 @@ subjects:
   name: kubeairunway
   namespace: kubeairunway-system
 
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: kubeairunway-hf-secret
-  namespace: kaito-workspace
-  labels:
-    app.kubernetes.io/name: kubeairunway
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kubeairunway-hf-secret
-subjects:
-- kind: ServiceAccount
-  name: kubeairunway
-  namespace: kubeairunway-system
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: kubeairunway-hf-secret
-  namespace: dynamo-system
-  labels:
-    app.kubernetes.io/name: kubeairunway
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kubeairunway-hf-secret
-subjects:
-- kind: ServiceAccount
-  name: kubeairunway
-  namespace: kubeairunway-system
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: kubeairunway-hf-secret
-  namespace: kuberay-system
-  labels:
-    app.kubernetes.io/name: kubeairunway
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kubeairunway-hf-secret
-subjects:
-- kind: ServiceAccount
-  name: kubeairunway
-  namespace: kubeairunway-system
-
 ---
 # Deployment
 apiVersion: apps/v1

deploy/kubernetes/hf-secret-rbac.yaml

@@ -0,0 +1,103 @@
+# HuggingFace Token Secret RBAC for Provider Namespaces
+#
+# Apply this AFTER installing providers to enable HuggingFace token
+# removal from provider namespaces via the dashboard UI.
+#
+# Usage: kubectl apply -f hf-secret-rbac.yaml
+#
+# This is only needed if you use the dashboard to manage HuggingFace tokens.
+# Each Role is scoped to resourceNames: ["hf-token-secret"] — the dashboard
+# can only delete this specific secret, nothing else.
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kubeairunway-hf-secret
+  namespace: kaito-workspace
+  labels:
+    app.kubernetes.io/name: kubeairunway
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["hf-token-secret"]
+  verbs: ["delete"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kubeairunway-hf-secret
+  namespace: dynamo-system
+  labels:
+    app.kubernetes.io/name: kubeairunway
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["hf-token-secret"]
+  verbs: ["delete"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kubeairunway-hf-secret
+  namespace: kuberay-system
+  labels:
+    app.kubernetes.io/name: kubeairunway
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["hf-token-secret"]
+  verbs: ["delete"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kubeairunway-hf-secret
+  namespace: kaito-workspace
+  labels:
+    app.kubernetes.io/name: kubeairunway
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubeairunway-hf-secret
+subjects:
+- kind: ServiceAccount
+  name: kubeairunway
+  namespace: kubeairunway-system
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kubeairunway-hf-secret
+  namespace: dynamo-system
+  labels:
+    app.kubernetes.io/name: kubeairunway
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubeairunway-hf-secret
+subjects:
+- kind: ServiceAccount
+  name: kubeairunway
+  namespace: kubeairunway-system
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kubeairunway-hf-secret
+  namespace: kuberay-system
+  labels:
+    app.kubernetes.io/name: kubeairunway
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubeairunway-hf-secret
+subjects:
+- kind: ServiceAccount
+  name: kubeairunway
+  namespace: kubeairunway-system

docs/versioning-upgrades.md

@@ -35,7 +35,7 @@ When moving between versions, conversion webhooks will handle:
 kubectl apply -f https://raw.githubusercontent.com/kaito-project/kubeairunway/main/deploy/kubernetes/controller.yaml
 
 # Rollback to previous version
-kubectl rollout undo deployment/kubeairunway-controller -n kubeairunway-system
+kubectl rollout undo deployment/kubeairunway-controller-manager -n kubeairunway-system
 ```
 
 **Behavior during upgrade:**