feat: support namespaceFilter on GET /workspacekinds

[utruong309]

Summary

Adds optional namespaceFilter query parameter to GET /workspacekinds to support Bella-centric listing while preserving existing admin behavior.

Behavior

• When namespaceFilter is provided:
  • Validates the value as a Kubernetes namespace
  • Applies CREATE Workspace authorization in the given namespace
• When not provided:
  • Uses existing LIST WorkspaceKind authorization

Motivation

This supports the dual-persona nature of /workspacekinds:

• Bella: selecting a WorkspaceKind to create a Workspace
• Joel: administrative listing of WorkspaceKinds

Acceptance Criteria

• namespaceFilter query parameter supported
• namespaceFilter validated (422 on invalid)
• Authorization policy depends on presence of namespaceFilter
• Existing behavior preserved when parameter is absent

[andyatmiami]

@utruong309 - really appreciate you becoming an active participant in the community by raising this PR!

I am nit-picking a lot here on your submission - but please know overall I am very happy with your grasp of this domain. please let me know if you have any questions on the comments/requests for change(s) I have made.

hopefully none of these asks are controversial and you are able to get them in fairly quickly - as I think we can then move to get this PR merged shortly thereafter 💯

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from andyatmiami. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• workspaces/backend/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[andyatmiami]

@utruong309

thanks for prompt resolution of initial round of comments.

i took a little deeper/more focused look at the current state of PR - and found a few other areas we will want to address. sorry I had overlooked these in initial review!

we are getting closer - please bear with me as we harden this! These should (hopefully) be the last of the significant changes I would request.

[utruong309]

Hey @andyatmiami,

Thanks for the detailed feedback! I've addressed all the comments. I also ran tests locally and everything looks good.

Please let me know if there’s anything else you’d like me to improve!

[andyatmiami]

/ok-to-test

[andyatmiami]

@utruong309

Just a heads up - as I was trying to (thoroughly) test various scenarios in your PR - particularly around setting DISABLE_AUTH: false on the backend deployment in our tilt cluster - I found a couple issues with our current existing implementation that is outside the scope of the work you are doing.

I am going to look to try and open up a fix ASAP to get it reviewed and merged.. but I will want to wait for that code to land.. so that then you can rebase this PR on top of that code and I can continue then testing to see your code working with SubjectAccessReview in our auth layer actually working

Stay tuned!