RBAC fix to enable slack cluster queue lending limit adjustment

[dgrove-oss]

The codeflare operator needs permission to read and write clusterqueues to enable the AppWrapper controller to adjust the lending limit of a designated slack cluster queue to reflect cordoned nodes.

[dgrove-oss]

Although we can work around this in MLBatch, it would be nice if this fix could be merged in time to make the next release so MLBatch only needs to have the patch for the codeflare operator's role in our configuration for RHOAI 2.12.

[varshaprasad96]

@dgrove-oss The changes seem good to provide right permissions to the slack CQ.

I assume this is only for the purposes of managing the Slack queue (as mentioned in the description). However, do we have admission policy (or a validating webhook) in place to not allow modifications to the slack CQ by anyone other than the app wrapper controller (would need a SA for this). Just concerned that we are not letting the same CQ be modified by Kueue as well as appwrapper controllers.

[dgrove-oss]

Summarizing an offline discussion, the lendingLimit field of the ClusterQueue won't be updated by the kueue controller. Cluster Admins in MLBatch are expected to modify the quota information in the slack ClusterQueue, but are expecting the AppWrapper controller to be modifying the lendingLimit. The AppWrapper controller re-computes the value of the lendingLimit each time from the quota and the node status, so even if the value was mistakenly modified by a cluster admin the AppWrapper controller would correct the mistake on the next reconcile by writing an updated value (after dealing with the reconcile conflict in the usual manner).

[varshaprasad96]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: varshaprasad96

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [varshaprasad96]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment