Skip to content

🐛 fix: add missing RBAC delete permission for MachinePools in ROSA controller#6089

Merged
kubernetes-prow[bot] merged 1 commit into
kubernetes-sigs:mainfrom
andclt:fix/rbac-rosanetwork
Jul 6, 2026
Merged

🐛 fix: add missing RBAC delete permission for MachinePools in ROSA controller#6089
kubernetes-prow[bot] merged 1 commit into
kubernetes-sigs:mainfrom
andclt:fix/rbac-rosanetwork

Conversation

@andclt

@andclt andclt commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

What type of PR is this?

/kind bug

What this PR does / why we need it:

The ROSAControlPlane controller attempts to delete CAPI MachinePool resources during cluster deletion to work around ROSA-HCP's architectural constraint (clusters cannot exist without MachinePools). However, the RBAC ClusterRole is missing the delete verb for machinepools resources, causing deletion to fail with permission errors.

This PR adds delete verb to the cluster.x-k8s.io/machinepools RBAC marker in rosacontrolplane_controller.go

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes https://redhat.atlassian.net/browse/ROSAENG-59186

Special notes for your reviewer:

AI Usage:

None

Checklist:

  • squashed commits
  • includes documentation
  • includes AI generated content
  • includes emoji in title
  • adds unit tests
  • adds or updates e2e tests

Release note:

fix(rosa): cluster deletion getting stuck due to missing RBAC permission for deleting MachinePools

@kubernetes-prow kubernetes-prow Bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/bug Categorizes issue or PR as related to a bug. needs-priority labels Jul 2, 2026
@kubernetes-prow kubernetes-prow Bot requested review from nrb and serngawy July 2, 2026 12:30
@kubernetes-prow kubernetes-prow Bot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 2, 2026
@kubernetes-prow

Copy link
Copy Markdown
Contributor

Hi @andclt. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@kubernetes-prow kubernetes-prow Bot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 2, 2026
@andclt andclt marked this pull request as ready for review July 2, 2026 12:30
@kubernetes-prow kubernetes-prow Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 2, 2026
@kubernetes-prow kubernetes-prow Bot requested a review from damdo July 2, 2026 12:30
@damdo

damdo commented Jul 3, 2026

Copy link
Copy Markdown
Member

/ok-to-test

@kubernetes-prow kubernetes-prow Bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 3, 2026

@damdo damdo left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@kubernetes-prow

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: damdo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubernetes-prow kubernetes-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 3, 2026
@damdo

damdo commented Jul 3, 2026

Copy link
Copy Markdown
Member

/assign @serngawy @nrb

@serngawy serngawy left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should also consider deleting the cluster CR to cascade delete the ROSACluster CR, otherwise both CRs will be left over. Lets do it in another PR, this PR looks good to me.

@damdo damdo left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@kubernetes-prow kubernetes-prow Bot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 6, 2026
@kubernetes-prow

Copy link
Copy Markdown
Contributor

LGTM label has been added.

DetailsGit tree hash: ecdfec320e262a7fbfc8b9f559a89f8d0bf71511

@kubernetes-prow kubernetes-prow Bot merged commit cd679e3 into kubernetes-sigs:main Jul 6, 2026
28 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants