fix: permit the Policy Reporter HTTPRoute to backend oauth2-proxy (SSO)

[devantler]

Why

Policy Reporter (#2459) is deployed and all its pods are healthy, but the UI is unreachable in the browser: its HTTPRoute backends cross-namespace to the shared oauth2-proxy SSO Service, and the policy-reporter namespace was missing from the ReferenceGrant that permits that reference. Gateway API therefore denied the backend (ResolvedRefs=False / RefNotPermitted), so no traffic reaches the UI.

What

Adds the policy-reporter HTTPRoute to the allow-oauth2-proxy-backends ReferenceGrant, exactly like the other SSO-fronted UIs (coroot/opencost/longhorn). Once merged, the route resolves and policy-reporter.<domain> loads.

Notes

• Hotfix for a live break — a one-line follow-up to feat: deploy Kyverno Policy Reporter (UI + kyverno plugin) #2459; needs prompt promotion to restore access.

🤖 Generated with Claude Code

[coderabbitai]

📝 Walkthrough

Walkthrough

A Kubernetes ReferenceGrant manifest for oauth2-proxy is updated to add a new spec.from rule permitting HTTPRoute resources from the policy-reporter namespace to reference the oauth2-proxy backend. Comments note this behavior is prod-only and inert in local/CI environments where the policy-reporter HTTPRoute does not exist.

Changes

Cohort / File	Change Summary
ReferenceGrant update — k8s/bases/infrastructure/controllers/oauth2-proxy/reference-grant.yaml	Added a spec.from entry allowing HTTPRoute cross-namespace access from policy-reporter namespace

Sequence Diagram(s)

Not applicable — configuration-only change to a Kubernetes manifest.

Estimated code review effort: 1 (Low)

Related issues: None provided.

Related PRs: None provided.

Suggested labels: kubernetes, configuration, low-risk

Suggested reviewers: None provided.

🐰 A grant expands, a route slips through,
From policy-reporter's namespace, hello there too,
In prod it hums, in test it's still,
A quiet line upon the hill.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly describes the main change: allowing Policy Reporter to reach oauth2-proxy via HTTPRoute.
Description check	✅ Passed	The description matches the changeset and explains the ReferenceGrant fix and its effect on Policy Reporter access.

---

_{Comment @coderabbitai help to get the list of available commands.}