OCPBUGS-12986: narrow down RBAC permissions

[ffromani]

Observe the usage pattern of the operator and narrow down as much as possible the RBAC permissions

AI-attribution: AIA PAI Ce Hin R claude-4.6-opus-1M v1.0

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ffromani

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ffromani]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@ffromani: This pull request references Jira Issue OCPBUGS-12986, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @shajmakh

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Observe the usage pattern of the operator and narrow down as much as possible the RBAC permissions

AI-attribution: AIA PAI Ce Hin R claude-4.6-opus-1M v1.0

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Warning

Review limit reached

@ffromani, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 32 minutes and 27 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: fec33fdf-aec1-4ed9-853b-f6e44abf9494

📥 Commits

Reviewing files that changed from the base of the PR and between 7e2965c and 7f427f4.

📒 Files selected for processing (6)

• bundle/manifests/numaresources-operator.clusterserviceversion.yaml
• config/rbac/role.yaml
• internal/controller/kubeletconfig_controller.go
• internal/controller/numaresourcesoperator_controller.go
• internal/controller/numaresourcesscheduler_controller.go
• rte/main.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch narrow-down-privileges

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ffromani]

/hold

requires pre-merge testing

[openshift-ci]

@ffromani: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ci-install-e2e-compact	7f427f4	link	false	/test ci-install-e2e-compact
ci/prow/ci-install-e2e	7f427f4	link	true	/test ci-install-e2e
ci/prow/ci-must-gather-e2e	7f427f4	link	true	/test ci-must-gather-e2e
ci/prow/ci-e2e-install-hypershift	7f427f4	link	true	/test ci-e2e-install-hypershift
ci/prow/ci-e2e-compact	7f427f4	link	false	/test ci-e2e-compact
ci/prow/ci-e2e	7f427f4	link	true	/test ci-e2e

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.