feat: improve interception for different implementations

[oliverbaehler]

• Reworks opt-in RoleBinding reflection using indexed controller-runtime caches, evaluating referenced Roles and
  ClusterRoles before exposing tenant resources.

• Adds correct GET/LIST handling for cluster-scoped proxy rules. Omitted operations default to both, while legacy LIST rules
  continue to imply GET.

• Supports create-if-missing workflows such as Helm’s --create-namespace without adding watches. A forbidden named-resource
  GET becomes 404 only when an authoritative lookup confirms the namespace is absent.

• Adds repeatable --ignored-username and Helm options.ignoredUsernames, matching ignored-group behavior: Capsule filtering
  is bypassed while Kubernetes impersonation and RBAC remain enforced.

• Improves self-access review handling and fixes XFCC error-message tests.

• Adds unit and e2e coverage for reflection, cluster-resource verbs, namespace creation, and ignored identities.

[Copilot]

Pull request overview

This PR improves Capsule-Proxy request interception and opt-in behaviors across multiple implementations by refining cluster-scoped rule semantics (GET/LIST), introducing username-based bypassing (analogous to ignored groups), and adding a response gate to better support “create-if-missing” workflows (e.g., Helm --create-namespace) without extra watches.

Changes:

• Add ignored-username / options.ignoredUsernames and update middleware to bypass Capsule filtering for configured usernames while keeping upstream impersonation/RBAC enforcement.
• Rework cluster-scoped rule operation handling so omitted operations default to GET+LIST, and legacy LIST implies GET for backward compatibility.
• Add a reverse-proxy ModifyResponse gate that rewrites 403→404 for named GETs only when an authoritative lookup confirms the namespace does not exist; expand unit + e2e coverage accordingly.

Reviewed changes

Copilot reviewed 35 out of 35 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Makefile	Updates local Helm install flags and kubeconfig generation to match new options/cert behavior.
main.go	Adds --ignored-username flag wiring into listener options.
internal/webserver/webserver.go	Registers namespace response gate; plumbs ignored usernames into kubeFilter.
internal/webserver/namespacegate/gate.go	Adds reverse-proxy response modifier to mask forbidden responses for missing namespaces.
internal/webserver/namespacegate/mask.go	Implements request parsing and 403→404 rewriting logic for missing namespaces.
internal/webserver/namespacegate/gate_test.go	Unit tests for namespace masking behavior and safety checks.
internal/webserver/middleware/user_in_group.go	Extends “ignored identity” checks to include usernames as well as groups.
internal/webserver/middleware/user_in_group_test.go	Tests ignored-username and ignored-group bypass behavior.
internal/runtime/validation/cluster_resource.go	Validates discovered cluster resources against effective GET/LIST operations.
internal/runtime/validation/cluster_resource_test.go	Tests default/explicit/legacy operation validation vs discovery verbs.
internal/request/xfcc_test.go	Updates expected XFCC error-message casing to match implementation.
internal/options/listener.go	Extends listener options interface with IgnoredUsernames().
internal/options/kube.go	Stores/exposes ignored usernames via kube options implementation.
internal/options/kube_test.go	Verifies ignored usernames/groups are preserved through NewKube.
internal/modules/utils/gvk.go	Improves core vs grouped URL parsing and generalizes discovery client interface.
internal/modules/utils/gvk_test.go	Adds coverage for core/grouped URL parsing and discovery groupVersion behavior.
internal/modules/tenants/utils.go	Filters cluster-scoped tenant matching based on GET vs LIST operation.
internal/modules/namespace/utils.go	Filters cluster-scoped namespace matching based on GET vs LIST operation.
internal/modules/clusterscoped/utils.go	Refactors requirement computation to be operation-specific (and nil-safe).
internal/modules/clusterscoped/utils_test.go	Tests operation-scoped selector behavior including legacy LIST→GET.
internal/modules/clusterscoped/list.go	Uses operation-scoped requirements for cluster-scoped LIST interception.
internal/modules/clusterscoped/get.go	Uses operation-scoped requirements for cluster-scoped GET interception.
internal/modules/clusterscoped/get_test.go	Adds GET interception tests for core + grouped resources and legacy LIST rules.
internal/authorization/middleware.go	Grants SelfSubjectAccessReview based on supported verb→operation mapping and effective ops.
internal/authorization/middleware_test.go	Expands tests for default/legacy ops injection and access-review verb handling.
e2e/namespace_creation_test.go	E2E coverage for create-if-missing masking and Capsule admission behavior.
e2e/global_resources_list_test.go	E2E coverage for default + explicit GET/LIST semantics and core path parsing.
charts/capsule-proxy/values.yaml	Adds options.ignoredUsernames and updates sample install values.
charts/capsule-proxy/values.schema.json	Adds schema entry for options.ignoredUsernames.
charts/capsule-proxy/templates/_pod.tpl	Renders --ignored-username flags from Helm values.
charts/capsule-proxy/README.md	Documents options.ignoredUsernames.
charts/capsule-proxy/crds/capsule.clastix.io_proxysettings.yaml	Updates ClusterResource operations defaults/docs to GET/LIST only.
charts/capsule-proxy/crds/capsule.clastix.io_globalproxysettings.yaml	Updates ClusterResource operations defaults/docs to GET/LIST only.
charts/capsule-proxy/ci/config-values.yaml	Adds CI chart values example for ignored usernames.
api/v1beta1/clusterresoure.go	Introduces GET operation, default/effective op helpers, and updated CRD markers/docs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.