Add dynamic k8s query feature

[ZachNo]

For the upcoming Dynamic K8s Query feature, add an option to enable it, and it's expanded set of read capabilities.

K8s doesn't have a deny list, only adding allows, so we're just adding some more basic constructs to the list instead of a wildcard by default.

[Copilot]

Pull request overview

Adds a Helm-chart configurable “dynamic Kubernetes query” capability for Chao/Gremlin by introducing a feature flag and an RBAC allowlist that extends the existing gremlin-watcher ClusterRole with additional read-only permissions when enabled.

Changes:

• Add chao.features.dynamicQuery values (flag + default allowlist) to control dynamic query behavior.
• Extend the gremlin-watcher ClusterRole rules and Chao container args when the feature is enabled.
• Add Helm template validations and helm-unittest coverage; document the feature and defaults in the chart README.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
gremlin/values.yaml	Introduces chao.features.dynamicQuery and a default RBAC allowlist.
gremlin/tests/notes_test.yaml	Adds template validation tests for dynamic query allowlist/verbs constraints.
gremlin/templates/chao-service-account.yaml	Conditionally appends allowlist RBAC rules to the gremlin-watcher ClusterRole.
gremlin/templates/chao-deployment.yaml	Conditionally enables Chao’s -dynamic_query flag.
gremlin/templates/_validation.tpl	Adds validations for allowlist presence and verb restrictions when enabled.
gremlin/README.md	Documents dynamic queries, configuration keys, and default allowlist intent.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.