fix: missing mismatched rbac rules (#958)

Author: olevski

bundle/manifests/amalthea.clusterserviceversion.yaml

@@ -21,7 +21,7 @@ metadata:
         }
       ]
     capabilities: Basic Install
-    createdAt: "2025-05-26T12:51:04Z"
+    createdAt: "2025-06-25T07:56:15Z"
     operators.operatorframework.io/builder: operator-sdk-v1.38.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
   name: amalthea.v0.0.1
@@ -100,9 +100,9 @@ spec:
           - ""
           resources:
           - persistentvolumeclaims
+          - services
           verbs:
           - create
-          - delete
           - get
           - list
           - patch
@@ -118,17 +118,6 @@ spec:
           - list
           - patch
           - watch
-        - apiGroups:
-          - ""
-          resources:
-          - services
-          verbs:
-          - create
-          - get
-          - list
-          - patch
-          - update
-          - watch
         - apiGroups:
           - metrics.k8s.io
           resources:

config/rbac/role.yaml

@@ -54,9 +54,9 @@ rules:
   - ""
   resources:
   - persistentvolumeclaims
+  - services
   verbs:
   - create
-  - delete
   - get
   - list
   - patch
@@ -72,17 +72,6 @@ rules:
   - list
   - patch
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - services
-  verbs:
-  - create
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - metrics.k8s.io
   resources:

helm-chart/amalthea-sessions/templates/manager-rbac.yaml

@@ -57,7 +57,7 @@ rules:
     - persistentvolumeclaims
     - services
     - ingresses
-  verbs: [create, get, list, watch]
+  verbs: [create, get, list, watch, patch, update]
 # Required for hibernating sessions
 - apiGroups: ["apps"]
   resources: ["statefulsets"]

internal/controller/amaltheasession_controller.go

@@ -53,7 +53,7 @@ const secretCleanupFinalizerName = "amalthea.dev/secrets-finalizer"
 // +kubebuilder:rbac:groups=amalthea.dev,resources=amaltheasessions/finalizers,verbs=update
 // +kubebuilder:rbac:groups=core,resources=secrets,verbs=list;watch;delete;create;patch
 // +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch
-// +kubebuilder:rbac:groups=core,resources=persistentvolumeclaims,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=core,resources=persistentvolumeclaims,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups=core,resources=events,verbs=get;list;watch
 // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;create;update;patch