chore: Simplify comments, group the rolebindings and clusterroles rules, and fix the crd management rule

Author: NickLarsenNZ

deploy/helm/hbase-operator/templates/roles.yaml

@@ -14,9 +14,7 @@ rules:
       - get
   # Manage core workload resources created per HbaseCluster.
   # All resources are applied via Server-Side Apply (create + patch) and tracked for
-  # orphan cleanup (list + delete). get is needed when reconciliation is paused (the
-  # operator reads current state instead of applying). Both resource types are watched
-  # by the controller (.owns(Service), .watches(ConfigMap)) so they also need watch.
+  # orphan cleanup (list + delete).
   # - configmaps: role group configuration and discovery configmap
   # - services: role group headless and metrics services
   - apiGroups:
@@ -31,10 +29,8 @@ rules:
       - list
       - patch
       - watch
-  # Manage ServiceAccounts created per HbaseCluster for workload pods.
-  # Applied via SSA (create + patch), tracked for orphan cleanup (list + delete).
-  # get is needed when reconciliation is paused.
-  # ServiceAccounts are not watched by the controller.
+  # ServiceAccount created per HbaseCluster for workload pod identity.
+  # Applied via SSA and tracked for orphan cleanup.
   - apiGroups:
       - ""
     resources:
@@ -45,10 +41,8 @@ rules:
       - get
       - list
       - patch
-  # Manage RoleBindings that bind the product ClusterRole to per-cluster ServiceAccounts.
-  # Applied via SSA (create + patch), tracked for orphan cleanup (list + delete).
-  # get is needed when reconciliation is paused.
-  # RoleBindings are not watched by the controller.
+  # RoleBinding created per HbaseCluster to bind the product ClusterRole to the workload
+  # ServiceAccount. Applied via SSA and tracked for orphan cleanup.
   - apiGroups:
       - rbac.authorization.k8s.io
     resources:
@@ -59,9 +53,16 @@ rules:
       - get
       - list
       - patch
-  # Manage StatefulSets created per role group.
-  # Applied via SSA (create + patch), tracked for orphan cleanup (list + delete),
-  # watched by the controller via .owns(StatefulSet), and read on pause (get).
+  # Required to bind the product ClusterRole to the per-cluster ServiceAccount.
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - clusterroles
+    verbs:
+      - bind
+    resourceNames:
+      - {{ include "operator.name" . }}-clusterrole
+  # StatefulSet created per role group. Applied via SSA and tracked for orphan cleanup.
   - apiGroups:
       - apps
     resources:
@@ -73,10 +74,7 @@ rules:
       - list
       - patch
       - watch
-  # Manage PodDisruptionBudgets created per role for availability guarantees.
-  # Applied via SSA (create + patch), tracked for orphan cleanup (list + delete).
-  # get is needed when reconciliation is paused.
-  # PodDisruptionBudgets are not watched by the controller.
+  # PodDisruptionBudget created per role. Applied via SSA and tracked for orphan cleanup.
   - apiGroups:
       - policy
     resources:
@@ -87,32 +85,31 @@ rules:
       - get
       - list
       - patch
+  # Required for maintaining the CRDs within the operator (including the conversion webhook info).
+  # Also for the startup condition check before the controller can run.
   - apiGroups:
       - apiextensions.k8s.io
     resources:
       - customresourcedefinitions
     verbs:
-      - get
+      {{- if .Values.maintenance.customResourceDefinitions.maintain }}
       # Required to maintain the CRD. The operator needs to do this, as it needs to enter e.g. it's
       # generated certificate in the conversion webhook.
-      {{- if .Values.maintenance.customResourceDefinitions.maintain }}
       - create
       - patch
+      {{- end }}
       # Required for startup condition
       - list
       - watch
-      {{- end }}
-  # For emitting Kubernetes events during reconciliation
+  # Required to report reconciliation results and warnings back to the HbaseCluster object.
   - apiGroups:
       - events.k8s.io
     resources:
       - events
     verbs:
       - create
       - patch
-  # The primary resource watched by the controller (Controller::new).
-  # get + list + watch are required for the controller to observe HbaseClusters.
-  # Status is updated via the separate /status subresource rule below.
+  # Primary CRD: watched by Controller::new() and read during reconciliation.
   - apiGroups:
       - {{ include "operator.name" . }}.stackable.tech
     resources:
@@ -121,24 +118,16 @@ rules:
       - get
       - list
       - watch
-  # For writing the HbaseCluster status subresource (apply_patch_status)
+  # Status subresource: updated at the end of every reconciliation.
   - apiGroups:
       - {{ include "operator.name" . }}.stackable.tech
     resources:
       - {{ include "operator.name" . }}clusters/status
     verbs:
       - patch
-  # For binding the product ClusterRole (hbase-clusterrole) to per-cluster ServiceAccounts
-  # via namespaced RoleBindings created per HbaseCluster
-  - apiGroups:
-      - rbac.authorization.k8s.io
-    resources:
-      - clusterroles
-    verbs:
-      - bind
-    resourceNames:
-      - {{ include "operator.name" . }}-clusterrole
 ---
+# Product ClusterRole: bound (via per HbaseCluster RoleBinding) to the ServiceAccount that HBase
+# workload pods (masters, regionServers, restServers) run as.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -155,7 +144,7 @@ rules:
       - create
       - patch
 {{ if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
-  # Required on OpenShift to allow HBase pods to run as non-root
+  # Required on OpenShift to allow the HBase pods to run as a non-root user.
   - apiGroups:
       - security.openshift.io
     resources: