From 88d1e3ac696764ac428d4b22caa696c70ec1452d Mon Sep 17 00:00:00 2001 From: Lukas Piwowarski Date: Tue, 21 Jul 2026 15:36:28 +0200 Subject: [PATCH] Remove unnecessary RBAC verbs Applied principle of least privilege across all RBAC markers in openstacklightspeed_controller.go. Verbs were removed where code analysis confirmed they are never exercised by the controller or the controller-runtime framework. ClusterRole changes: - openstacklightspeeds: removed create, delete, update; get, list, watch, patch are sufficient for normal reconciliation - openstacklightspeeds/status: removed get, update; only patch is needed to update the status subresource - clusterroles: removed update, delete; CreateOrPatch uses get/create/patch, bulk removal uses deletecollection (DeleteAllOf) - clusterrolebindings: same reasoning as clusterroles - clusterversions: removed watch only; list is retained because the operator grants list to the app-server SAR ClusterRole and cannot grant permissions it does not hold - consoleplugins: removed update; get/list/watch/create/patch/delete cover all actual operations Role (namespaced) changes: - clusterserviceversions: removed patch; only update and delete are needed for owner reference and uninstall - networkpolicies: removed update; CreateOrPatch uses get/create/patch - deployments: removed update, delete; CreateOrPatch uses get/create/patch; owned resources are GC'd by Kubernetes - configmaps: removed update; get/list/watch/create/patch/delete cover all actual operations (one ConfigMap is explicitly deleted on toggle) - secrets: removed update, delete; bulk removal uses deletecollection (DeleteAllOf); owned secrets are GC'd by Kubernetes - services: removed update, delete; CreateOrPatch uses get/create/patch; owned resources are GC'd by Kubernetes - persistentvolumeclaims: removed update; get/list/watch/create/patch cover all actual operations; PVCs are intentionally never deleted Co-Authored-By: Claude Sonnet 4.6 --- ...tspeed-operator.clusterserviceversion.yaml | 32 ++----------------- config/rbac/role.yaml | 30 ++--------------- .../openstacklightspeed_controller.go | 28 ++++++++-------- 3 files changed, 19 insertions(+), 71 deletions(-) diff --git a/bundle/manifests/openstack-lightspeed-operator.clusterserviceversion.yaml b/bundle/manifests/openstack-lightspeed-operator.clusterserviceversion.yaml index cf7f1fb..d9a8cc1 100644 --- a/bundle/manifests/openstack-lightspeed-operator.clusterserviceversion.yaml +++ b/bundle/manifests/openstack-lightspeed-operator.clusterserviceversion.yaml @@ -25,7 +25,7 @@ metadata: ] capabilities: Basic Install categories: AI/Machine Learning - createdAt: "2026-07-13T09:32:13Z" + createdAt: "2026-07-21T15:55:56Z" description: AI-powered virtual assistant for Red Hat OpenStack Services on OpenShift features.operators.openshift.io/cnf: "false" features.operators.openshift.io/cni: "false" @@ -177,7 +177,6 @@ spec: verbs: - get - list - - watch - apiGroups: - console.openshift.io resources: @@ -188,19 +187,15 @@ spec: - get - list - patch - - update - watch - apiGroups: - lightspeed.openstack.org resources: - openstacklightspeeds verbs: - - create - - delete - get - list - patch - - update - watch - apiGroups: - lightspeed.openstack.org @@ -213,9 +208,7 @@ spec: resources: - openstacklightspeeds/status verbs: - - get - patch - - update - apiGroups: - operator.openshift.io resources: @@ -240,12 +233,10 @@ spec: - clusterroles verbs: - create - - delete - deletecollection - get - list - patch - - update - watch - apiGroups: - authentication.k8s.io @@ -380,25 +371,24 @@ spec: - "" resources: - configmaps - - services verbs: - create - delete - get - list - patch - - update - watch - apiGroups: - "" resources: - persistentvolumeclaims + - serviceaccounts + - services verbs: - create - get - list - patch - - update - watch - apiGroups: - "" @@ -406,22 +396,10 @@ spec: - secrets verbs: - create - - delete - deletecollection - get - list - patch - - update - - watch - - apiGroups: - - "" - resources: - - serviceaccounts - verbs: - - create - - get - - list - - patch - watch - apiGroups: - apps @@ -429,11 +407,9 @@ spec: - deployments verbs: - create - - delete - get - list - patch - - update - watch - apiGroups: - networking.k8s.io @@ -444,7 +420,6 @@ spec: - get - list - patch - - update - watch - apiGroups: - operators.coreos.com @@ -452,7 +427,6 @@ spec: - clusterserviceversions verbs: - delete - - patch - update serviceAccountName: openstack-lightspeed-operator-controller-manager strategy: deployment diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 613a800..2dc18ec 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -19,7 +19,6 @@ rules: verbs: - get - list - - watch - apiGroups: - console.openshift.io resources: @@ -30,19 +29,15 @@ rules: - get - list - patch - - update - watch - apiGroups: - lightspeed.openstack.org resources: - openstacklightspeeds verbs: - - create - - delete - get - list - patch - - update - watch - apiGroups: - lightspeed.openstack.org @@ -55,9 +50,7 @@ rules: resources: - openstacklightspeeds/status verbs: - - get - patch - - update - apiGroups: - operator.openshift.io resources: @@ -82,12 +75,10 @@ rules: - clusterroles verbs: - create - - delete - deletecollection - get - list - patch - - update - watch --- apiVersion: rbac.authorization.k8s.io/v1 @@ -100,25 +91,24 @@ rules: - "" resources: - configmaps - - services verbs: - create - delete - get - list - patch - - update - watch - apiGroups: - "" resources: - persistentvolumeclaims + - serviceaccounts + - services verbs: - create - get - list - patch - - update - watch - apiGroups: - "" @@ -126,22 +116,10 @@ rules: - secrets verbs: - create - - delete - deletecollection - get - list - patch - - update - - watch -- apiGroups: - - "" - resources: - - serviceaccounts - verbs: - - create - - get - - list - - patch - watch - apiGroups: - apps @@ -149,11 +127,9 @@ rules: - deployments verbs: - create - - delete - get - list - patch - - update - watch - apiGroups: - networking.k8s.io @@ -164,7 +140,6 @@ rules: - get - list - patch - - update - watch - apiGroups: - operators.coreos.com @@ -172,5 +147,4 @@ rules: - clusterserviceversions verbs: - delete - - patch - update diff --git a/internal/controller/openstacklightspeed_controller.go b/internal/controller/openstacklightspeed_controller.go index 5556164..e5aadbf 100644 --- a/internal/controller/openstacklightspeed_controller.go +++ b/internal/controller/openstacklightspeed_controller.go @@ -54,24 +54,24 @@ func (r *OpenStackLightspeedReconciler) GetLogger(ctx context.Context) logr.Logg return log.FromContext(ctx).WithName("Controllers").WithName("OpenStackLightspeed") } -// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds,verbs=get;list;watch;create;update;patch;delete -// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds/status,verbs=get;update;patch +// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds,verbs=get;list;watch;patch +// +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds/status,verbs=patch // +kubebuilder:rbac:groups=lightspeed.openstack.org,resources=openstacklightspeeds/finalizers,verbs=update -// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=get;list;watch;create;patch;update;delete;deletecollection -// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;list;watch;create;patch;update;delete;deletecollection +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=get;list;watch;create;patch;deletecollection +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;list;watch;create;patch;deletecollection // +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,verbs=get;list;watch -// +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,namespace=openstack-lightspeed,verbs=update;patch;delete -// +kubebuilder:rbac:groups=config.openshift.io,resources=clusterversions,verbs=get;list;watch +// +kubebuilder:rbac:groups=operators.coreos.com,resources=clusterserviceversions,namespace=openstack-lightspeed,verbs=update;delete +// +kubebuilder:rbac:groups=config.openshift.io,resources=clusterversions,verbs=get;list // +kubebuilder:rbac:groups="",resources=secrets,resourceNames=pull-secret,verbs=get -// +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update -// +kubebuilder:rbac:groups=apps,resources=deployments,namespace=openstack-lightspeed,verbs=get;list;watch;create;update;patch;delete -// +kubebuilder:rbac:groups="",resources=configmaps,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update;delete -// +kubebuilder:rbac:groups="",resources=secrets,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update;delete;deletecollection -// +kubebuilder:rbac:groups="",resources=services,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update;delete +// +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch +// +kubebuilder:rbac:groups=apps,resources=deployments,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch +// +kubebuilder:rbac:groups="",resources=configmaps,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;delete +// +kubebuilder:rbac:groups="",resources=secrets,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;deletecollection +// +kubebuilder:rbac:groups="",resources=services,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch // +kubebuilder:rbac:groups="",resources=serviceaccounts,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch -// +kubebuilder:rbac:groups=console.openshift.io,resources=consoleplugins,verbs=get;list;watch;create;update;patch;delete -// +kubebuilder:rbac:groups=operator.openshift.io,resources=consoles,verbs=watch;list;get;update -// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch;update +// +kubebuilder:rbac:groups=console.openshift.io,resources=consoleplugins,verbs=get;list;watch;create;patch;delete +// +kubebuilder:rbac:groups=operator.openshift.io,resources=consoles,verbs=get;list;watch;update +// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,namespace=openstack-lightspeed,verbs=get;list;watch;create;patch func (r *OpenStackLightspeedReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { Log := r.GetLogger(ctx)