feat(mpi): add --disable-mpi-rbac-management flag

[vicoooo26]

What this PR does / why we need it:

Adds a new --disable-mpi-rbac-management CLI flag (default: false) to the MPIJob controller. When set to true, the controller will:

• Not create ServiceAccount, Role, or RoleBinding for MPIJob launchers
• Not inject ServiceAccountName into the launcher pod template
• Not watch RBAC resources (Role, RoleBinding, ServiceAccount)

This allows operators to run with reduced privileges and supports multi-tenant environments where users pre-provide their own ServiceAccount with the necessary permissions (pods get/list/watch, pods/exec create) via spec.serviceAccountName in the launcher pod template.

Which issue(s) this PR fixes (optional, in Fixes #<issue number>, #<issue number>, ... format, will close the issue(s) when PR gets merged):
Fixes #

Checklist:

- [ ] Docs included if any changes are user facing

[vicoooo26]

@cheyang, could you please review this PR? Thanks in advance.

[cheyang]

Reviewed the feature end to end and ran the MPI envtest suite against this PR head — the added “disabled RBAC management” specs pass. The gating is consistent across the three sites (watch setup, ReconcilePods, launcher SA injection), and since podSpec is a DeepCopy of the launcher template, a user-supplied serviceAccountName is correctly preserved when the flag is on. Two things worth addressing before merge, plus a docs gap (inline).

[Copilot]

Pull request overview

Adds a new --disable-mpi-rbac-management flag to allow the MPIJob controller to run without creating/watching launcher RBAC resources, enabling reduced-privilege / multi-tenant deployments where users provide their own ServiceAccount.

Changes:

• Gate RBAC watches (Role/RoleBinding/ServiceAccount) behind DisableMPIRBACManagement.
• Skip launcher ServiceAccount/Role/RoleBinding reconciliation and ServiceAccountName injection when RBAC management is disabled.
• Add CLI/config plumbing and controller tests covering the disabled-RBAC behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
pkg/controller.v1/mpi/mpijob_controller.go	Conditionally disables RBAC watches, RBAC resource creation, and SA name injection based on the new config flag.
pkg/controller.v1/mpi/mpijob_controller_test.go	Adds envtest coverage verifying no RBAC resources are created and controller still reconciles correctly when disabled.
pkg/config/config.go	Adds DisableMPIRBACManagement to shared controller config.
cmd/training-operator.v1/main.go	Wires up the --disable-mpi-rbac-management CLI flag.

Comments suppressed due to low confidence (1)

pkg/controller.v1/mpi/mpijob_controller_test.go:711

• This test resets DisableMPIRBACManagement to false unconditionally. Restoring the previous value reduces coupling to global state and avoids surprising behavior if the suite default ever changes.

			ctlrconfig.Config.DisableMPIRBACManagement = true
			defer func() {
				ctlrconfig.Config.DisableMPIRBACManagement = false
			}()

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.