[ganeshmshetty]

What this PR does / why we need it:

make manifests now writes the rules of the Helm chart's manager ClusterRole (charts/kubeflow-trainer/templates/rbac/clusterrole.yaml) from the controller-gen output in manifests/base/rbac/role.yaml. It already does the same for the CRDs. Only the metadata block stays chart-specific. Because test-go.yaml runs make generate and fails on a dirty tree, RBAC drift like the one fixed in #4271 now fails CI instead of slipping through.

After regenerating, the chart has the same rules as the kustomize role. That removes the extra create on runtimes and OptimizationJobs (the same change as #4271) and moves the apps/deployments rule to controller-gen's order. The license header becomes the year-less Helm boilerplate, which the CRD templates already use. I updated the clusterrole_test.yaml assertion to match. If #4271 lands first, I'll merge master in.

Checked locally:

• make manifests is idempotent. If the chart template is edited by hand, it gets rewritten back, and rules: is identical to manifests/base/rbac/role.yaml.
• make helm-unittest: 22 suites / 98 tests pass
• helm lint charts/kubeflow-trainer passes

Not run: full make generate/test-go (Python API codegen needs a container runtime) and helm-lint via chart-testing (needs Docker).

Written with AI assistance and reviewed by me, per the Kubeflow AI policy.

Which issue(s) this PR fixes:
Fixes #4290

Checklist:

• Docs included if any changes are user facing (not user facing)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

🎉 Welcome to the Kubeflow Trainer! 🎉

Thanks for opening your first PR! We're happy to have you as part of our community 🚀

Here's what happens next:

• If you haven't already, please check out our Contributing Guide for repo-specific guidelines and the Kubeflow Contributor Guide for general community standards.
• Our team will review your PR soon! cc @kubeflow/kubeflow-trainer-team

Join the community:

• Slack: Join our #kubeflow-trainer Slack channel.
• Meetings: Attend the Kubeflow AutoML and Training Working Group bi-weekly meetings.

Feel free to ask questions in the comments if you need any help or clarification!
Thanks again for contributing to Kubeflow! 🙏

[andreyvelich]

Thanks @ganeshmshetty,
Can you rebase your PR please?
/ok-to-test

[ganeshmshetty]

Rebased on master (kept the new notContains check from #4271), thanks @andreyvelich 🙏

[andreyvelich]

Thanks @ganeshmshetty!
/lgtm
/approve

[google-oss-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andreyvelich

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [andreyvelich]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ganeshmshetty]

Thanks for the review and merge @andreyvelich 🙏