Remove unnecessary pods RBAC permissions

The workload rbacRules and kubebuilder RBAC markers granted the operator and
its workload service account full CRUD (create/delete/get/list/patch/update/
watch) on core Pods, but the operator never reads or writes Pod objects
directly — pods only ever come into being indirectly via Deployments/
StatefulSets/Jobs. Remove the unused pods permission and regenerate
config/rbac/role.yaml.

Signed-off-by: Martin Schuppert <mschuppert@redhat.com>

Author: stuggi

config/rbac/role.yaml

@@ -7,7 +7,6 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - pods
   - secrets
   - services
   verbs:

internal/controller/watcher_controller.go

@@ -89,7 +89,6 @@ func (r *WatcherReconciler) GetLogger(ctx context.Context) logr.Logger {
 //+kubebuilder:rbac:groups=rabbitmq.openstack.org,resources=transporturls,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=keystone.openstack.org,resources=keystoneservices,verbs=get;list;watch;create;update;patch;delete;
 //+kubebuilder:rbac:groups=keystone.openstack.org,resources=keystoneendpoints,verbs=get;list;watch;create;update;patch;delete;
-//+kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
 //+kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete;
 // +kubebuilder:rbac:groups=batch,resources=cronjobs,verbs=get;list;watch;create;update;patch;delete;
 //+kubebuilder:rbac:groups=route.openshift.io,resources=routes,verbs=get;list;watch;create;update;patch;delete;
@@ -683,11 +682,6 @@ func (r *WatcherReconciler) ensureRbac(
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},
-		{
-			APIGroups: []string{""},
-			Resources: []string{"pods"},
-			Verbs:     []string{"create", "get", "list", "watch", "update", "patch", "delete"},
-		},
 	}
 
 	rbacResult, err := common_rbac.ReconcileRbac(ctx, h, instance, rbacRules)

test/functional/watcher_controller_test.go

@@ -163,9 +163,8 @@ var _ = Describe("Watcher controller", func() {
 				corev1.ConditionTrue,
 			)
 			role := th.GetRole(watcherTest.RoleName)
-			Expect(role.Rules).To(HaveLen(2))
+			Expect(role.Rules).To(HaveLen(1))
 			Expect(role.Rules[0].Resources).To(Equal([]string{"securitycontextconstraints"}))
-			Expect(role.Rules[1].Resources).To(Equal([]string{"pods"}))
 
 			th.ExpectCondition(
 				watcherTest.Instance,