SREP-3469 Add read-only backplane RBAC for ROSAAiAgent

[tiwillia]

What type of PR is this?

feature

What this PR does / why we need it?

Create cluster-side namespace and SubjectPermission for the ROSAAiAgent backplane role. Uses only backplane-readers-cluster and dedicated-readers (Tier 3 pattern) to guarantee read-only access with no write, elevation, or impersonation capabilities.

Which Jira/Github issue(s) this PR fixes?

SREP-3469
Relates to #2665

Special notes for your reviewer:

Relates to https://gitlab.cee.redhat.com/service/uhc-account-manager/-/merge_requests/5158 which introduces the role in AMS

Summary by CodeRabbit

• Chores
  • Configured AI agent service deployment infrastructure, including namespace provisioning, access control policies for service account permissions, and deployment settings for the OpenShift environment.

[coderabbitai]

Walkthrough

This pull request introduces a new Kubernetes/OpenShift deployment for an AI agent service in the backplane, adding a namespace definition, subject permission controls, and deployment configuration files. All changes are declarative manifest additions without functional code modifications.

Changes

Cohort / File(s)	Summary
AI Agent Backplane Deployment deploy/backplane/ai-agent/00-ai-agent.namespace.yml, deploy/backplane/ai-agent/20-ai-agent.SubjectPermission.yml, deploy/backplane/ai-agent/config.yaml	Adds OpenShift/Kubernetes manifests to establish a new namespace (openshift-backplane-ai-agent) with associated cluster and namespace-level access controls via SubjectPermission, plus deployment configuration specifying SelectorSyncSet mode.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding read-only backplane RBAC configuration for the ROSAAiAgent, which is exactly what the three new YAML manifests accomplish.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Stable And Deterministic Test Names	✅ Passed	The pull request contains no Ginkgo test files or test code. The three files added are Kubernetes YAML manifest files for RBAC configuration, not tests.
Test Structure And Quality	✅ Passed	This PR exclusively adds static YAML configuration files for Kubernetes/OpenShift infrastructure with no test files to review.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tiwillia
Once this PR has been reviewed and has the lgtm label, please assign iamkirkbater for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• deploy/backplane/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@tiwillia: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.