chore: remove the update permissions for VolumeSnapshotClass (#9512)

Author: leon-ape

config/rbac/role.yaml

@@ -977,20 +977,9 @@ rules:
   resources:
   - volumesnapshotclasses
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
-- apiGroups:
-  - snapshot.storage.k8s.io
-  resources:
-  - volumesnapshotclasses/finalizers
-  verbs:
-  - patch
-  - update
 - apiGroups:
   - snapshot.storage.k8s.io
   resources:

controllers/dataprotection/backup_controller.go

@@ -76,8 +76,7 @@ type BackupReconciler struct {
 // +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=snapshot.storage.k8s.io,resources=volumesnapshots,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=snapshot.storage.k8s.io,resources=volumesnapshots/finalizers,verbs=update;patch
-// +kubebuilder:rbac:groups=snapshot.storage.k8s.io,resources=volumesnapshotclasses,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=snapshot.storage.k8s.io,resources=volumesnapshotclasses/finalizers,verbs=update;patch
+// +kubebuilder:rbac:groups=snapshot.storage.k8s.io,resources=volumesnapshotclasses,verbs=get;list;watch
 
 // +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=get;list;watch;create;update;patch;delete

controllers/dataprotection/log_collection_controller_test.go

@@ -65,7 +65,6 @@ var _ = Describe("Log Collection Controller", func() {
 		testapps.ClearResources(&testCtx, generics.StorageClassSignature, ml)
 		testapps.ClearResourcesWithRemoveFinalizerOption(&testCtx, generics.PersistentVolumeSignature, true, ml)
 		testapps.ClearResources(&testCtx, generics.StorageProviderSignature, ml)
-		testapps.ClearResources(&testCtx, generics.VolumeSnapshotClassSignature, ml)
 	}
 
 	BeforeEach(func() {

deploy/helm/config/rbac/role.yaml

@@ -977,20 +977,9 @@ rules:
   resources:
   - volumesnapshotclasses
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
-- apiGroups:
-  - snapshot.storage.k8s.io
-  resources:
-  - volumesnapshotclasses/finalizers
-  verbs:
-  - patch
-  - update
 - apiGroups:
   - snapshot.storage.k8s.io
   resources:

pkg/dataprotection/backup/request_test.go

@@ -77,7 +77,6 @@ var _ = Describe("Request Test", func() {
 		testapps.ClearResources(&testCtx, generics.StorageClassSignature, ml)
 		testapps.ClearResourcesWithRemoveFinalizerOption(&testCtx, generics.BackupRepoSignature, true, ml)
 		testapps.ClearResources(&testCtx, generics.StorageProviderSignature, ml)
-		testapps.ClearResources(&testCtx, generics.VolumeSnapshotClassSignature, ml)
 		testapps.ClearResourcesWithRemoveFinalizerOption(&testCtx, generics.PersistentVolumeSignature, true, ml)
 	}
 

pkg/testutil/apps/native_object_util.go

@@ -20,10 +20,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 package apps
 
 import (
-	vsv1 "github.com/kubernetes-csi/external-snapshotter/client/v6/apis/volumesnapshot/v1"
 	corev1 "k8s.io/api/core/v1"
 	storagev1 "k8s.io/api/storage/v1"
-	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/kubectl/pkg/util/storage"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -52,23 +50,6 @@ func NewConfigMap(namespace, name string, options ...any) *corev1.ConfigMap {
 	return cm
 }
 
-func SetConfigMapData(key string, value string) func(*corev1.ConfigMap) {
-	return func(configMap *corev1.ConfigMap) {
-		configMap.Data[key] = value
-	}
-}
-
-func NewPVC(size string) corev1.PersistentVolumeClaimSpec {
-	return corev1.PersistentVolumeClaimSpec{
-		AccessModes: []corev1.PersistentVolumeAccessMode{corev1.ReadWriteOnce},
-		Resources: corev1.VolumeResourceRequirements{
-			Requests: corev1.ResourceList{
-				corev1.ResourceStorage: resource.MustParse(size),
-			},
-		},
-	}
-}
-
 func CreateStorageClass(testCtx *testutil.TestContext, storageClassName string,
 	allowVolumeExpansion bool) *storagev1.StorageClass {
 	storageClass := &storagev1.StorageClass{
@@ -83,14 +64,3 @@ func CreateStorageClass(testCtx *testutil.TestContext, storageClassName string,
 	}
 	return CreateK8sResource(testCtx, storageClass).(*storagev1.StorageClass)
 }
-
-func CreateVolumeSnapshotClass(testCtx *testutil.TestContext) {
-	volumeSnapshotClass := &vsv1.VolumeSnapshotClass{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: "default-vs",
-		},
-		Driver:         testutil.DefaultCSIDriver,
-		DeletionPolicy: vsv1.VolumeSnapshotContentDelete,
-	}
-	CreateK8sResource(testCtx, volumeSnapshotClass)
-}