[Kevin Cho (chokevin)]

Summary

CPU-only workloads that requested topology could pass connected queue preflight even when every eligible CPU flavor lacked topology support. The CLI now detects CPU requests in rendered workloads and rejects incompatible queue selections before submission, while accepting topology-capable CPU flavors.

• Propagates whether rendered containers or init containers request CPU into queue validation.
• Treats topology annotations as compute topology requests for CPU-only workloads as well as GPU workloads.
• Verifies that an eligible CPU flavor advertises topology support and returns an actionable error when none does.
• Grants workspace researchers the narrow cluster-scoped get permission needed to inspect ResourceFlavor topology capability in both Helm and Kustomize installs.
• Preserves ResourceFlavor authorization failures while adding explicit guidance to grant read access or ask the platform owner to inspect the queue.
• Adds regression coverage for both incompatible and compatible CPU flavor selections.

Related issue

N/A

Validation

Passed: cd cli && GOTOOLCHAIN=local go test -count=1 ./internal/cli ./internal/queueresolve
  ok github.com/Azure/taugrid/cli/internal/cli
  ok github.com/Azure/taugrid/cli/internal/queueresolve

Passed: cd cli && GOTOOLCHAIN=local go vet ./internal/queueresolve

Passed: cd controllers/tau-core && GOTOOLCHAIN=local go test -race -count=1 ./internal/controller
  ok github.com/Azure/taugrid/controllers/tau-core/internal/controller

Passed with Helm 3.18.6 and Helm 4.2.0:
  helm lint charts/tau-core-controller
  helm template test charts/tau-core-controller --namespace taugrid-system
  helm unittest charts/tau-core-controller
  5 suites and 17 tests passed for each Helm version.

Passed: bash -n controllers/tau-core/scripts/kind-e2e.sh

Passed: python3 scripts/check-license-headers.py
  License header check passed for 924 source files.

Passed: git diff --check origin/main...HEAD

Evidence

The updated 16-second recording shows the focused ResourceFlavor read grant, its least-privilege boundary, and the new Forbidden/actionable-guidance regression. Detailed command results remain in the validation section above.

cpu-topology-forbidden-guidance.mp4

Compatibility and operational impact

CLI connected preflight is intentionally stricter for CPU-only workloads that set policy.topology: queues whose eligible CPU flavors do not support topology-aware scheduling are rejected before submission. The shipped workspace researcher RBAC now permits cluster-scoped ResourceFlavor get requests, but still does not grant list, watch, or mutation access. Public APIs, CRDs, configuration formats, images, and dependencies are unchanged. Documentation is not changed because this aligns shipped authorization with an existing preflight read rather than introducing a new user-facing command, flag, or configuration contract.

Checklist

• The change is focused and does not include unrelated edits.
• Tests cover the changed behavior, or I explained why tests are not needed.
• Documentation and examples are updated when public behavior changes.
• Generated files are updated from their source and included in this pull request.
• New dependencies are publicly available and their license and provenance were reviewed.
• The diff contains no secrets, private endpoints, customer data, or Microsoft-internal information.
• Fork-based CI can validate the change without repository secrets, or maintainer-only validation is clearly identified.

AI assistance: GitHub Copilot isolated the requested commit, ran the listed checks, produced the evidence recording, and drafted this description; the claims and final text were verified against the branch.