From 7b1edf87d564e302e3ad0c7c31b68ce6b429522e Mon Sep 17 00:00:00 2001 From: Lukas Piwowarski Date: Tue, 21 Jul 2026 15:36:28 +0200 Subject: [PATCH] Remove unnecessary RBAC verbs from operator ClusterRole and Role Reduced permissions on three resources following the principle of least privilege: - openstacklightspeeds (ClusterRole): removed create, delete, update; get, list, watch, patch are sufficient for normal reconciliation - openstacklightspeeds/status (ClusterRole): removed get and update; only patch is needed to update status subresource - clusterserviceversions (namespaced Role): removed patch; only update and delete are needed for owner reference and uninstall Regenerated config/rbac/role.yaml and bundle manifests via make manifests && make bundle. Closes OSPRH-30842 --- bundle.Dockerfile | 2 +- ...tack-lightspeed-operator.clusterserviceversion.yaml | 10 ++-------- bundle/metadata/annotations.yaml | 2 +- config/rbac/role.yaml | 6 ------ internal/controller/openstacklightspeed_controller.go | 6 +++--- 5 files changed, 7 insertions(+), 19 deletions(-) diff --git a/bundle.Dockerfile b/bundle.Dockerfile index 3b92ba1..80659d5 100644 --- a/bundle.Dockerfile +++ b/bundle.Dockerfile @@ -6,7 +6,7 @@ LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/ LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/ LABEL operators.operatorframework.io.bundle.package.v1=openstack-lightspeed-operator LABEL operators.operatorframework.io.bundle.channels.v1=alpha -LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.38.0 +LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.42.0 LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1 LABEL operators.operatorframework.io.metrics.project_layout=go.kubebuilder.io/v4 diff --git a/bundle/manifests/openstack-lightspeed-operator.clusterserviceversion.yaml b/bundle/manifests/openstack-lightspeed-operator.clusterserviceversion.yaml index cf7f1fb..f505b5a 100644 --- a/bundle/manifests/openstack-lightspeed-operator.clusterserviceversion.yaml +++ b/bundle/manifests/openstack-lightspeed-operator.clusterserviceversion.yaml @@ -25,7 +25,7 @@ metadata: ] capabilities: Basic Install categories: AI/Machine Learning - createdAt: "2026-07-13T09:32:13Z" + createdAt: "2026-07-21T13:30:58Z" description: AI-powered virtual assistant for Red Hat OpenStack Services on OpenShift features.operators.openshift.io/cnf: "false" features.operators.openshift.io/cni: "false" @@ -38,7 +38,7 @@ metadata: features.operators.openshift.io/token-auth-azure: "false" features.operators.openshift.io/token-auth-gcp: "false" operatorframework.io/suggested-namespace: openstack-lightspeed - operators.operatorframework.io/builder: operator-sdk-v1.38.0 + operators.operatorframework.io/builder: operator-sdk-v1.42.0 operators.operatorframework.io/project_layout: go.kubebuilder.io/v4 repository: https://github.com/openstack-k8s-operators/lightspeed-operator name: openstack-lightspeed-operator.v0.0.1 @@ -195,12 +195,9 @@ spec: resources: - openstacklightspeeds verbs: - - create - - delete - get - list - patch - - update - watch - apiGroups: - lightspeed.openstack.org @@ -213,9 +210,7 @@ spec: resources: - openstacklightspeeds/status verbs: - - get - patch - - update - apiGroups: - operator.openshift.io resources: @@ -452,7 +447,6 @@ spec: - clusterserviceversions verbs: - delete - - patch - update serviceAccountName: openstack-lightspeed-operator-controller-manager strategy: deployment diff --git a/bundle/metadata/annotations.yaml b/bundle/metadata/annotations.yaml index 828f4f1..634562d 100644 --- a/bundle/metadata/annotations.yaml +++ b/bundle/metadata/annotations.yaml @@ -5,7 +5,7 @@ annotations: operators.operatorframework.io.bundle.metadata.v1: metadata/ operators.operatorframework.io.bundle.package.v1: openstack-lightspeed-operator operators.operatorframework.io.bundle.channels.v1: alpha - operators.operatorframework.io.metrics.builder: operator-sdk-v1.38.0 + operators.operatorframework.io.metrics.builder: operator-sdk-v1.42.0 operators.operatorframework.io.metrics.mediatype.v1: metrics+v1 operators.operatorframework.io.metrics.project_layout: go.kubebuilder.io/v4 diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 613a800..1a45c8b 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -37,12 +37,9 @@ rules: resources: - openstacklightspeeds verbs: - - create - - delete - get - list - patch - - update - watch - apiGroups: - lightspeed.openstack.org @@ -55,9 +52,7 @@ rules: resources: - openstacklightspeeds/status verbs: - - get - patch - - update - apiGroups: - operator.openshift.io resources: @@ -172,5 +167,4 @@ rules: - clusterserviceversions verbs: - delete - - patch - update diff --git a/internal/controller/openstacklightspeed_controller.go b/internal/controller/openstacklightspeed_controller.go index 5556164..f770072 100644 --- a/internal/controller/openstacklightspeed_controller.go +++ b/internal/controller/openstacklightspeed_controller.go @@ -54,13 +54,13 @@ func (r *OpenStackLightspeedReconciler) GetLogger(ctx context.Context) logr.Logg return log.FromContext(ctx).WithName("Controllers").WithName("OpenStackLightspeed") } -// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds,verbs=get;list;watch;create;update;patch;delete -// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds/status,verbs=get;update;patch +// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds,verbs=get;list;watch;patch +// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds/status,verbs=patch // +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds/finalizers,verbs=update // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=get;list;watch;create;patch;update;delete;deletecollection // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;list;watch;create;patch;update;delete;deletecollection // +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,verbs=get;list;watch -// +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,namespace=openstack-lightspeed,verbs=update;patch;delete +// +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,namespace=openstack-lightspeed,verbs=update;delete // +kubebuilder:rbac:groups=config.openshift.io,resources=clusterversions,verbs=get;list;watch // +kubebuilder:rbac:groups="",resources=secrets,resourceNames=pull-secret,verbs=get // +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update