Remove unnecessary RBAC verbs

Applied principle of least privilege across all RBAC markers in
openstacklightspeed_controller.go. Verbs were removed where code
analysis confirmed they are never exercised by the controller.

ClusterRole changes:
- openstacklightspeeds: removed create, delete, update; get, list,
  watch, patch are sufficient for normal reconciliation
- openstacklightspeeds/status: removed get, update; only patch is
  needed to update the status subresource
- clusterroles: removed list, update, delete; CreateOrPatch uses
  get/create/patch, bulk removal uses deletecollection (DeleteAllOf)
- clusterrolebindings: same reasoning as clusterroles
- clusterversions: removed list, watch; only a single Get is
  performed to detect the OCP version
- consoleplugins: removed list, update; get/create/patch/delete/watch
  cover all actual operations

Role (namespaced) changes:
- clusterserviceversions: removed patch; only update and delete are
  needed for owner reference and uninstall
- networkpolicies: removed list, update; CreateOrPatch uses
  get/create/patch; owned resources are GC'd by Kubernetes
- deployments: removed list, update, delete; CreateOrPatch uses
  get/create/patch; owned resources are GC'd by Kubernetes
- configmaps: removed list, update; get/create/patch/delete cover all
  actual operations (one ConfigMap is explicitly deleted on toggle)
- secrets: removed list, update, delete; bulk removal uses
  deletecollection (DeleteAllOf); owned secrets are GC'd
- services: removed list, update, delete; CreateOrPatch uses
  get/create/patch; owned resources are GC'd by Kubernetes
- consoles: removed list, watch; only Get and Update are called
- persistentvolumeclaims: removed list, update; get/create/patch/watch
  cover all actual operations; PVCs are intentionally never deleted

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: lpiwowar

bundle/manifests/openstack-lightspeed-operator.clusterserviceversion.yaml

@@ -25,7 +25,7 @@ metadata:
       ]
     capabilities: Basic Install
     categories: AI/Machine Learning
-    createdAt: "2026-07-13T09:32:13Z"
+    createdAt: "2026-07-21T13:42:49Z"
     description: AI-powered virtual assistant for Red Hat OpenStack Services on OpenShift
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "false"
@@ -176,8 +176,6 @@ spec:
           - clusterversions
           verbs:
           - get
-          - list
-          - watch
         - apiGroups:
           - console.openshift.io
           resources:
@@ -186,21 +184,16 @@ spec:
           - create
           - delete
           - get
-          - list
           - patch
-          - update
           - watch
         - apiGroups:
           - lightspeed.openstack.org
           resources:
           - openstacklightspeeds
           verbs:
-          - create
-          - delete
           - get
           - list
           - patch
-          - update
           - watch
         - apiGroups:
           - lightspeed.openstack.org
@@ -213,18 +206,14 @@ spec:
           resources:
           - openstacklightspeeds/status
           verbs:
-          - get
           - patch
-          - update
         - apiGroups:
           - operator.openshift.io
           resources:
           - consoles
           verbs:
           - get
-          - list
           - update
-          - watch
         - apiGroups:
           - operators.coreos.com
           resources:
@@ -240,12 +229,9 @@ spec:
           - clusterroles
           verbs:
           - create
-          - delete
           - deletecollection
           - get
-          - list
           - patch
-          - update
           - watch
         - apiGroups:
           - authentication.k8s.io
@@ -380,38 +366,31 @@ spec:
           - ""
           resources:
           - configmaps
-          - services
           verbs:
           - create
           - delete
           - get
-          - list
           - patch
-          - update
           - watch
         - apiGroups:
           - ""
           resources:
           - persistentvolumeclaims
+          - services
           verbs:
           - create
           - get
-          - list
           - patch
-          - update
           - watch
         - apiGroups:
           - ""
           resources:
           - secrets
           verbs:
           - create
-          - delete
           - deletecollection
           - get
-          - list
           - patch
-          - update
           - watch
         - apiGroups:
           - ""
@@ -429,11 +408,8 @@ spec:
           - deployments
           verbs:
           - create
-          - delete
           - get
-          - list
           - patch
-          - update
           - watch
         - apiGroups:
           - networking.k8s.io
@@ -442,17 +418,14 @@ spec:
           verbs:
           - create
           - get
-          - list
           - patch
-          - update
           - watch
         - apiGroups:
           - operators.coreos.com
           resources:
           - clusterserviceversions
           verbs:
           - delete
-          - patch
           - update
         serviceAccountName: openstack-lightspeed-operator-controller-manager
     strategy: deployment

config/rbac/role.yaml

@@ -18,8 +18,6 @@ rules:
   - clusterversions
   verbs:
   - get
-  - list
-  - watch
 - apiGroups:
   - console.openshift.io
   resources:
@@ -28,21 +26,16 @@ rules:
   - create
   - delete
   - get
-  - list
   - patch
-  - update
   - watch
 - apiGroups:
   - lightspeed.openstack.org
   resources:
   - openstacklightspeeds
   verbs:
-  - create
-  - delete
   - get
   - list
   - patch
-  - update
   - watch
 - apiGroups:
   - lightspeed.openstack.org
@@ -55,18 +48,14 @@ rules:
   resources:
   - openstacklightspeeds/status
   verbs:
-  - get
   - patch
-  - update
 - apiGroups:
   - operator.openshift.io
   resources:
   - consoles
   verbs:
   - get
-  - list
   - update
-  - watch
 - apiGroups:
   - operators.coreos.com
   resources:
@@ -82,12 +71,9 @@ rules:
   - clusterroles
   verbs:
   - create
-  - delete
   - deletecollection
   - get
-  - list
   - patch
-  - update
   - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -100,38 +86,31 @@ rules:
   - ""
   resources:
   - configmaps
-  - services
   verbs:
   - create
   - delete
   - get
-  - list
   - patch
-  - update
   - watch
 - apiGroups:
   - ""
   resources:
   - persistentvolumeclaims
+  - services
   verbs:
   - create
   - get
-  - list
   - patch
-  - update
   - watch
 - apiGroups:
   - ""
   resources:
   - secrets
   verbs:
   - create
-  - delete
   - deletecollection
   - get
-  - list
   - patch
-  - update
   - watch
 - apiGroups:
   - ""
@@ -149,11 +128,8 @@ rules:
   - deployments
   verbs:
   - create
-  - delete
   - get
-  - list
   - patch
-  - update
   - watch
 - apiGroups:
   - networking.k8s.io
@@ -162,15 +138,12 @@ rules:
   verbs:
   - create
   - get
-  - list
   - patch
-  - update
   - watch
 - apiGroups:
   - operators.coreos.com
   resources:
   - clusterserviceversions
   verbs:
   - delete
-  - patch
   - update

internal/controller/openstacklightspeed_controller.go

@@ -54,24 +54,24 @@ func (r *OpenStackLightspeedReconciler) GetLogger(ctx context.Context) logr.Logg
 	return log.FromContext(ctx).WithName("Controllers").WithName("OpenStackLightspeed")
 }
 
-// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds,verbs=get;list;watch;patch
+// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds/status,verbs=patch
 // +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds/finalizers,verbs=update
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=get;list;watch;create;patch;update;delete;deletecollection
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;list;watch;create;patch;update;delete;deletecollection
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=get;watch;create;patch;deletecollection
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;watch;create;patch;deletecollection
 // +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,verbs=get;list;watch
-// +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,namespace=openstack-lightspeed,verbs=update;patch;delete
-// +kubebuilder:rbac:groups=config.openshift.io,resources=clusterversions,verbs=get;list;watch
+// +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,namespace=openstack-lightspeed,verbs=update;delete
+// +kubebuilder:rbac:groups=config.openshift.io,resources=clusterversions,verbs=get
 // +kubebuilder:rbac:groups="",resources=secrets,resourceNames=pull-secret,verbs=get
-// +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update
-// +kubebuilder:rbac:groups=apps,resources=deployments,namespace=openstack-lightspeed,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups="",resources=configmaps,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update;delete
-// +kubebuilder:rbac:groups="",resources=secrets,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update;delete;deletecollection
-// +kubebuilder:rbac:groups="",resources=services,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update;delete
+// +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,namespace=openstack-lightspeed,verbs=get;watch;create;patch
+// +kubebuilder:rbac:groups=apps,resources=deployments,namespace=openstack-lightspeed,verbs=get;watch;create;patch
+// +kubebuilder:rbac:groups="",resources=configmaps,namespace=openstack-lightspeed,verbs=get;watch;create;patch;delete
+// +kubebuilder:rbac:groups="",resources=secrets,namespace=openstack-lightspeed,verbs=get;watch;create;patch;deletecollection
+// +kubebuilder:rbac:groups="",resources=services,namespace=openstack-lightspeed,verbs=get;watch;create;patch
 // +kubebuilder:rbac:groups="",resources=serviceaccounts,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch
-// +kubebuilder:rbac:groups=console.openshift.io,resources=consoleplugins,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=operator.openshift.io,resources=consoles,verbs=watch;list;get;update
-// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update
+// +kubebuilder:rbac:groups=console.openshift.io,resources=consoleplugins,verbs=get;watch;create;patch;delete
+// +kubebuilder:rbac:groups=operator.openshift.io,resources=consoles,verbs=get;update
+// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,namespace=openstack-lightspeed,verbs=get;watch;create;patch
 
 func (r *OpenStackLightspeedReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	Log := r.GetLogger(ctx)