fix(manifests): Add list bucket to IAM policy

[tarekabouzeid]

Description of your changes:

Kserve storage initializer is running HeadBucket  on arn:aws:s3:::mlpipeline , need to update IAM policy to allow that.

Checklist:

• You have signed off your commits
• The title for your pull request (PR) should follow our title convention. Learn more about the pull request title convention used in this repository.

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign juliusvonkohout for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• manifests/kustomize/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the IAM policy generated by the pipelines profile controller to include an explicit bucket-level permission needed by some S3 clients (e.g., KServe storage-initializer) while keeping object permissions scoped to specific prefixes.

Changes:

• Split the single S3 statement into separate bucket-level and object-level statements.
• Added s3:ListBucket on the bucket resource to support bucket-level checks prior to object access.

[juliusvonkohout]

Is there a secure way to implement this?

[juliusvonkohout]

Thank you for the PR.

can you verify

1. that you cannot list objects from other namespaces, sicne that would break enterprise multi tenancy. You could make it configurable behind an off bey default flag if the multi-tenancy is violated.
2. Are you sure about the kserver storage initializer needing it? i recently had an occurence where it worked with the status quo.
3. we would need to extend the current multi tenancy tests to also verify that listing objects beyond tenancy borders is blocked, not just downloading.

/hold