Remove unnecessary RBAC verbs

Applied principle of least privilege across all RBAC markers in
openstacklightspeed_controller.go. Verbs were removed where code
analysis confirmed they are never exercised by the controller or
the controller-runtime framework.

ClusterRole changes:
- openstacklightspeeds: removed create, delete, update; get, list,
  watch, patch are sufficient for normal reconciliation
- openstacklightspeeds/status: removed get, update; only patch is
  needed to update the status subresource
- clusterroles: removed update, delete; CreateOrPatch uses
  get/create/patch, bulk removal uses deletecollection (DeleteAllOf)
- clusterrolebindings: same reasoning as clusterroles
- clusterversions: removed watch only; list is retained because the
  operator grants list to the app-server SAR ClusterRole and cannot
  grant permissions it does not hold
- consoleplugins: removed update; get/list/watch/create/patch/delete
  cover all actual operations

Role (namespaced) changes:
- clusterserviceversions: removed patch; only update and delete are
  needed for owner reference and uninstall
- networkpolicies: removed update; CreateOrPatch uses get/create/patch
- deployments: removed update, delete; CreateOrPatch uses
  get/create/patch; owned resources are GC'd by Kubernetes
- configmaps: removed update; get/list/watch/create/patch/delete cover
  all actual operations (one ConfigMap is explicitly deleted on toggle)
- secrets: removed update, delete; bulk removal uses deletecollection
  (DeleteAllOf); owned secrets are GC'd by Kubernetes
- services: removed update, delete; CreateOrPatch uses
  get/create/patch; owned resources are GC'd by Kubernetes
- persistentvolumeclaims: removed update; get/list/watch/create/patch
  cover all actual operations; PVCs are intentionally never deleted

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: lpiwowar

bundle/manifests/openstack-lightspeed-operator.clusterserviceversion.yaml

@@ -25,7 +25,7 @@ metadata:
       ]
     capabilities: Basic Install
     categories: AI/Machine Learning
-    createdAt: "2026-07-13T09:32:13Z"
+    createdAt: "2026-07-21T15:55:56Z"
     description: AI-powered virtual assistant for Red Hat OpenStack Services on OpenShift
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "false"
@@ -177,7 +177,6 @@ spec:
           verbs:
           - get
           - list
-          - watch
         - apiGroups:
           - console.openshift.io
           resources:
@@ -188,19 +187,15 @@ spec:
           - get
           - list
           - patch
-          - update
           - watch
         - apiGroups:
           - lightspeed.openstack.org
           resources:
           - openstacklightspeeds
           verbs:
-          - create
-          - delete
           - get
           - list
           - patch
-          - update
           - watch
         - apiGroups:
           - lightspeed.openstack.org
@@ -213,9 +208,7 @@ spec:
           resources:
           - openstacklightspeeds/status
           verbs:
-          - get
           - patch
-          - update
         - apiGroups:
           - operator.openshift.io
           resources:
@@ -240,12 +233,10 @@ spec:
           - clusterroles
           verbs:
           - create
-          - delete
           - deletecollection
           - get
           - list
           - patch
-          - update
           - watch
         - apiGroups:
           - authentication.k8s.io
@@ -380,60 +371,45 @@ spec:
           - ""
           resources:
           - configmaps
-          - services
           verbs:
           - create
           - delete
           - get
           - list
           - patch
-          - update
           - watch
         - apiGroups:
           - ""
           resources:
           - persistentvolumeclaims
+          - serviceaccounts
+          - services
           verbs:
           - create
           - get
           - list
           - patch
-          - update
           - watch
         - apiGroups:
           - ""
           resources:
           - secrets
           verbs:
           - create
-          - delete
           - deletecollection
           - get
           - list
           - patch
-          - update
-          - watch
-        - apiGroups:
-          - ""
-          resources:
-          - serviceaccounts
-          verbs:
-          - create
-          - get
-          - list
-          - patch
           - watch
         - apiGroups:
           - apps
           resources:
           - deployments
           verbs:
           - create
-          - delete
           - get
           - list
           - patch
-          - update
           - watch
         - apiGroups:
           - networking.k8s.io
@@ -444,15 +420,13 @@ spec:
           - get
           - list
           - patch
-          - update
           - watch
         - apiGroups:
           - operators.coreos.com
           resources:
           - clusterserviceversions
           verbs:
           - delete
-          - patch
           - update
         serviceAccountName: openstack-lightspeed-operator-controller-manager
     strategy: deployment

config/rbac/role.yaml

@@ -19,7 +19,6 @@ rules:
   verbs:
   - get
   - list
-  - watch
 - apiGroups:
   - console.openshift.io
   resources:
@@ -30,19 +29,15 @@ rules:
   - get
   - list
   - patch
-  - update
   - watch
 - apiGroups:
   - lightspeed.openstack.org
   resources:
   - openstacklightspeeds
   verbs:
-  - create
-  - delete
   - get
   - list
   - patch
-  - update
   - watch
 - apiGroups:
   - lightspeed.openstack.org
@@ -55,9 +50,7 @@ rules:
   resources:
   - openstacklightspeeds/status
   verbs:
-  - get
   - patch
-  - update
 - apiGroups:
   - operator.openshift.io
   resources:
@@ -82,12 +75,10 @@ rules:
   - clusterroles
   verbs:
   - create
-  - delete
   - deletecollection
   - get
   - list
   - patch
-  - update
   - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -100,60 +91,45 @@ rules:
   - ""
   resources:
   - configmaps
-  - services
   verbs:
   - create
   - delete
   - get
   - list
   - patch
-  - update
   - watch
 - apiGroups:
   - ""
   resources:
   - persistentvolumeclaims
+  - serviceaccounts
+  - services
   verbs:
   - create
   - get
   - list
   - patch
-  - update
   - watch
 - apiGroups:
   - ""
   resources:
   - secrets
   verbs:
   - create
-  - delete
   - deletecollection
   - get
   - list
   - patch
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - serviceaccounts
-  verbs:
-  - create
-  - get
-  - list
-  - patch
   - watch
 - apiGroups:
   - apps
   resources:
   - deployments
   verbs:
   - create
-  - delete
   - get
   - list
   - patch
-  - update
   - watch
 - apiGroups:
   - networking.k8s.io
@@ -164,13 +140,11 @@ rules:
   - get
   - list
   - patch
-  - update
   - watch
 - apiGroups:
   - operators.coreos.com
   resources:
   - clusterserviceversions
   verbs:
   - delete
-  - patch
   - update

internal/controller/openstacklightspeed_controller.go

@@ -54,24 +54,24 @@ func (r *OpenStackLightspeedReconciler) GetLogger(ctx context.Context) logr.Logg
 	return log.FromContext(ctx).WithName("Controllers").WithName("OpenStackLightspeed")
 }
 
-// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds,verbs=get;list;watch;patch
+// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds/status,verbs=patch
 // +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds/finalizers,verbs=update
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=get;list;watch;create;patch;update;delete;deletecollection
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;list;watch;create;patch;update;delete;deletecollection
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=get;list;watch;create;patch;deletecollection
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;list;watch;create;patch;deletecollection
 // +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,verbs=get;list;watch
-// +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,namespace=openstack-lightspeed,verbs=update;patch;delete
-// +kubebuilder:rbac:groups=config.openshift.io,resources=clusterversions,verbs=get;list;watch
+// +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,namespace=openstack-lightspeed,verbs=update;delete
+// +kubebuilder:rbac:groups=config.openshift.io,resources=clusterversions,verbs=get;list
 // +kubebuilder:rbac:groups="",resources=secrets,resourceNames=pull-secret,verbs=get
-// +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update
-// +kubebuilder:rbac:groups=apps,resources=deployments,namespace=openstack-lightspeed,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups="",resources=configmaps,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update;delete
-// +kubebuilder:rbac:groups="",resources=secrets,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update;delete;deletecollection
-// +kubebuilder:rbac:groups="",resources=services,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update;delete
+// +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch
+// +kubebuilder:rbac:groups=apps,resources=deployments,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch
+// +kubebuilder:rbac:groups="",resources=configmaps,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;delete
+// +kubebuilder:rbac:groups="",resources=secrets,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;deletecollection
+// +kubebuilder:rbac:groups="",resources=services,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch
 // +kubebuilder:rbac:groups="",resources=serviceaccounts,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch
-// +kubebuilder:rbac:groups=console.openshift.io,resources=consoleplugins,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=operator.openshift.io,resources=consoles,verbs=watch;list;get;update
-// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update
+// +kubebuilder:rbac:groups=console.openshift.io,resources=consoleplugins,verbs=get;list;watch;create;patch;delete
+// +kubebuilder:rbac:groups=operator.openshift.io,resources=consoles,verbs=get;list;watch;update
+// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch
 
 func (r *OpenStackLightspeedReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	Log := r.GetLogger(ctx)