Skip to content

Commit 585c936

Browse files
lmicciniclaude
lmiccini
and
claude
committed
Remove unused pods/exec and pods create RBAC from operator ClusterRole
The pods/exec create permission was vestigial — no exec code exists in the codebase (no remotecommand, SPDY, or exec helper calls). The pods create permission was also unused — pods are managed by StatefulSet, not created directly by the controller. Retain pods get/list/watch/update/delete (needed for labeling pods with skipPreStopChecks during CR deletion and deleting pods with short grace period) and pods update/patch (needed by BGP controller for pod label management). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 59d2055 commit 585c936

6 files changed

Lines changed: 15 additions & 24 deletions

File tree

‎apis/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ go 1.26.3
55
require (
66
github.com/go-logr/logr v1.4.3
77
github.com/onsi/gomega v1.42.1
8-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67
8+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260724091355-a86f6d29e055
99
k8s.io/api v0.33.13
1010
k8s.io/apiextensions-apiserver v0.33.13
1111
k8s.io/apimachinery v0.33.13

‎apis/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,8 @@ github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
8181
github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
8282
github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4 h1:YVY7Mb0AdJBbNgC/Zz9R/ZwhixOmZNA8P+6ZPaDW/0M=
8383
github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4/go.mod h1:SPLf21TYPipzCO67BURkCfK6dcIIxx0oNRVWaOyRcXM=
84-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67 h1:crgFl4DA5n38huc043ux21jEQM7UaRMXsi+wogDOYn0=
85-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67/go.mod h1:yA4tbcB62Dml5d0SP3n14hbwLVrKFicm690/eTWvusc=
84+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260724091355-a86f6d29e055 h1:aQy9n6lVrxJWF0KA3R7TpD/qfYDJedL5UQJRuS3hm+k=
85+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260724091355-a86f6d29e055/go.mod h1:yA4tbcB62Dml5d0SP3n14hbwLVrKFicm690/eTWvusc=
8686
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
8787
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
8888
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

‎config/rbac/role.yaml‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ rules:
88
- ""
99
resources:
1010
- configmaps
11-
- pods
1211
- secrets
1312
- serviceaccounts
1413
- services
@@ -47,19 +46,14 @@ rules:
4746
- ""
4847
resources:
4948
- persistentvolumeclaims
49+
- pods
5050
verbs:
5151
- delete
5252
- get
5353
- list
5454
- patch
5555
- update
5656
- watch
57-
- apiGroups:
58-
- ""
59-
resources:
60-
- pods/exec
61-
verbs:
62-
- create
6357
- apiGroups:
6458
- apps
6559
resources:

‎go.mod‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ require (
1111
github.com/onsi/gomega v1.42.1
1212
github.com/openshift/api v3.9.0+incompatible
1313
github.com/openstack-k8s-operators/infra-operator/apis v0.0.0-00010101000000-000000000000
14-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67
15-
github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260717092345-ab1ee7b97c67
16-
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260717092345-ab1ee7b97c67
14+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260724091355-a86f6d29e055
15+
github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260724091355-a86f6d29e055
16+
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260724091355-a86f6d29e055
1717
go.uber.org/zap v1.28.0
1818
golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67
1919
k8s.io/api v0.33.13
@@ -136,5 +136,3 @@ replace k8s.io/component-base => k8s.io/component-base v0.33.13 //allow-merging
136136
replace k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20250627150254-e9823e99808e //allow-merging
137137

138138
replace github.com/cert-manager/cmctl/v2 => github.com/cert-manager/cmctl/v2 v2.3.0 //allow-merging
139-
140-
replace github.com/openstack-k8s-operators/lib-common/modules/common => github.com/lmiccini/lib-common/modules/common v0.0.0-20260723143954-3bd9f32306fb

‎go.sum‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -94,8 +94,6 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
9494
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
9595
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
9696
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
97-
github.com/lmiccini/lib-common/modules/common v0.0.0-20260723143954-3bd9f32306fb h1:J/e1Hvlt1ntRvHxUyapJ8DhsuJQZHEv8vS+a3/9FZmI=
98-
github.com/lmiccini/lib-common/modules/common v0.0.0-20260723143954-3bd9f32306fb/go.mod h1:yA4tbcB62Dml5d0SP3n14hbwLVrKFicm690/eTWvusc=
9997
github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
10098
github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
10199
github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
@@ -118,10 +116,12 @@ github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
118116
github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
119117
github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4 h1:YVY7Mb0AdJBbNgC/Zz9R/ZwhixOmZNA8P+6ZPaDW/0M=
120118
github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4/go.mod h1:SPLf21TYPipzCO67BURkCfK6dcIIxx0oNRVWaOyRcXM=
121-
github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260717092345-ab1ee7b97c67 h1:EoBTLbbfGRC37uA0J6al5zeZfQSxy6XwsUMNZAWCQPA=
122-
github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260717092345-ab1ee7b97c67/go.mod h1:IN0pCq/v2MsPcXrtcBIqcpVEqyq8oTIbNahmsc3tu28=
123-
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260717092345-ab1ee7b97c67 h1:GmakXxpm0scnNPuFDC9fSdhqo8MPyyBqqL0UW8pNh5o=
124-
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260717092345-ab1ee7b97c67/go.mod h1:W41icuwPMCo1MlVBwkFTFf5oHEYtV59oT9yKce5fcHI=
119+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260724091355-a86f6d29e055 h1:aQy9n6lVrxJWF0KA3R7TpD/qfYDJedL5UQJRuS3hm+k=
120+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260724091355-a86f6d29e055/go.mod h1:yA4tbcB62Dml5d0SP3n14hbwLVrKFicm690/eTWvusc=
121+
github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260724091355-a86f6d29e055 h1:8EKLg+aMklM3kXIjbyhy6Ssvce6dKy+oTT6cUrMTq4A=
122+
github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260724091355-a86f6d29e055/go.mod h1:IN0pCq/v2MsPcXrtcBIqcpVEqyq8oTIbNahmsc3tu28=
123+
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260724091355-a86f6d29e055 h1:5efDvK9x0T8C8jEraByDlcroagFMLA9f7zRF9rwG1z4=
124+
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260724091355-a86f6d29e055/go.mod h1:W41icuwPMCo1MlVBwkFTFf5oHEYtV59oT9yKce5fcHI=
125125
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
126126
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
127127
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

‎internal/controller/rabbitmq/rabbitmq_controller.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -130,9 +130,8 @@ type Reconciler struct {
130130
// +kubebuilder:rbac:groups=config.openshift.io,resources=networks,verbs=get;list;watch;
131131
// +kubebuilder:rbac:groups="",resources=nodes,verbs=get;list
132132

133-
// Required to exec into pods
134-
// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;create;update;patch;delete;
135-
// +kubebuilder:rbac:groups=core,resources=pods/exec,verbs=create
133+
// Required to label and delete pods during CR deletion
134+
// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;update;delete
136135

137136
// Required to manage PodDisruptionBudgets for multi-replica deployments
138137
// +kubebuilder:rbac:groups=policy,resources=poddisruptionbudgets,verbs=get;list;watch;create;update;patch;delete

0 commit comments

Comments
 (0)