fix(noderesource): use apiGroup in rbac-proxy config (not group)

[bdchatham]

Summary

GenerateRBACProxyConfigMap was writing the resource API group under the wrong field name in the kube-rbac-proxy ConfigMap. This caused the proxy to silently drop the field, SAR against an empty apiGroup, and return 403 for every authenticated /v0/tasks call.

# Before                          # After
authorization:                    authorization:
  resourceAttributes:               resourceAttributes:
    group: sei.io        # wrong     apiGroup: sei.io     # correct
    resource: seinodetasks            resource: seinodetasks
    ...                               ...

The field name apiGroup matches kube-rbac-proxy's authz.ResourceAttributes struct in pkg/authz/auth.go. Note this is the proxy's config struct, not the K8s SubjectAccessReview API (which uses group). The two are distinct types with overlapping but non-identical field names; only the proxy's struct is the source of truth for what its config file accepts.

How it surfaced

Today's harbor nightly-load smoke test exercised the post-PR-#267 RBAC chain end-to-end for the first time. Symptoms:

• Direct kubectl create subjectaccessreview with group=sei.io for the controller SA → allowed=true
• Controller's POST to proxy's /v0/tasks → 403 Forbidden with body user=...controller-manager, verb=create, resource=seinodetasks, subresource=

Same user, same resource, same verb, opposite answers. The mismatch is the proxy's SAR using apiGroup="" (empty) because group: is an unknown field in its config struct.

Test plan

• TestGenerateRBACProxyConfigMap_UsesApiGroup updated to assert apiGroup: sei.io
• make test passes
• After merge + image build + platform overlay bump: re-trigger harbor nightly-load cron, confirm both SNDs reach Ready (which requires every node's MarkReady to succeed through the proxy)

Deployment ordering

1. Merge this PR
2. CI builds + pushes new controller image
3. Bump config/manager/manager.yaml (controller-repo PR) so the default image picks up the fix
4. Bump platform overlays — at minimum harbor (currently pinned via manager-patch.yaml); prod/dev inherit from the controller's default

🤖 Generated with Claude Code

[cursor]

You have used all Bugbot PR reviews included in your free trial for your GitHub account on this workspace.

To continue using Bugbot reviews, enable Bugbot for your team in the Cursor dashboard.