chore: Split the clusterroles between operator and product

Author: NickLarsenNZ

…/helm/hdfs-operator/templates/roles.yaml …ator/templates/clusterrole-operator.yamldeploy/helm/hdfs-operator/templates/roles.yaml renamed to deploy/helm/hdfs-operator/templates/clusterrole-operator.yaml deploy/helm/hdfs-operator/templates/roles.yaml renamed to deploy/helm/hdfs-operator/templates/clusterrole-operator.yaml

@@ -143,90 +143,3 @@ rules:
       - bind
     resourceNames:
       - {{ include "operator.name" . }}-clusterrole
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "operator.name" . }}-clusterrole
-  labels:
-  {{- include "operator.labels" . | nindent 4 }}
-rules:
-  # Read configuration and identity resources mounted or referenced by product pods.
-  # - configmaps: HDFS configuration files
-  # - secrets: TLS certificates and Kerberos keytabs (provided by secret-operator volumes)
-  # - serviceaccounts: bound service account token projection
-  # - pods: pod self-inspection (e.g. hostname resolution, ZooKeeper coordination)
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - secrets
-      - serviceaccounts
-      - pods
-    verbs:
-      - get
-  # List pods for topology detection and peer discovery.
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - list
-  # Required to report events from HDFS product pods.
-  - apiGroups:
-      - events.k8s.io
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
-{{ if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
-  # Required on OpenShift to allow HDFS pods to run as a non-root user.
-  - apiGroups:
-      - security.openshift.io
-    resources:
-      - securitycontextconstraints
-    resourceNames:
-      - nonroot-v2
-    verbs:
-      - use
-{{ end }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "operator.name" . }}-clusterrole-nodes
-  labels:
-  {{- include "operator.labels" . | nindent 4 }}
-rules:
-  # The topology provider (rack awareness) running inside HDFS pods queries pod, node, and
-  # endpoint information to compute rack labels for DataNodes.
-  # - pods: discover pod-to-node assignment for topology calculation; watched by pod informer
-  # - nodes: read rack labels (e.g. topology.kubernetes.io/zone) from the node the pod runs on
-  # - endpoints: map service endpoints to pod IPs for topology resolution
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-      - nodes
-      - endpoints
-    verbs:
-      - get
-      - list
-      # needed for pod informer
-      - watch
-  # Read listener addresses so HDFS pods can resolve external access endpoints.
-  - apiGroups:
-      - listeners.stackable.tech
-    resources:
-      - listeners
-    verbs:
-      - get
-      - list
-  # Required to discover the installed CRD API version before querying listeners.
-  - apiGroups:
-      - apiextensions.k8s.io
-    resources:
-      - customresourcedefinitions
-    verbs:
-      - get

deploy/helm/hdfs-operator/templates/clusterrole-product.yaml

@@ -0,0 +1,92 @@
+---
+# Product ClusterRole: bound (via per-HdfsCluster RoleBinding) to the ServiceAccount that HDFS
+# workload pods (namenodes, datanodes, journalnodes) run as.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "operator.name" . }}-clusterrole
+  labels:
+  {{- include "operator.labels" . | nindent 4 }}
+rules:
+  # Read configuration and identity resources mounted or referenced by product pods.
+  # - configmaps: HDFS configuration files
+  # - secrets: TLS certificates and Kerberos keytabs (provided by secret-operator volumes)
+  # - serviceaccounts: bound service account token projection
+  # - pods: pod self-inspection (e.g. hostname resolution, ZooKeeper coordination)
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - secrets
+      - serviceaccounts
+      - pods
+    verbs:
+      - get
+  # List pods for topology detection and peer discovery.
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - list
+  # Required to report events from HDFS product pods.
+  - apiGroups:
+      - events.k8s.io
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+{{ if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
+  # Required on OpenShift to allow HDFS pods to run as a non-root user.
+  - apiGroups:
+      - security.openshift.io
+    resources:
+      - securitycontextconstraints
+    resourceNames:
+      - nonroot-v2
+    verbs:
+      - use
+{{ end }}
+---
+# Nodes ClusterRole: bound (via a single cluster-scoped ClusterRoleBinding) to the same
+# ServiceAccount. Grants the additional permissions needed by the HDFS topology provider
+# for rack awareness, which requires cluster-wide pod, node, and endpoint access.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "operator.name" . }}-clusterrole-nodes
+  labels:
+  {{- include "operator.labels" . | nindent 4 }}
+rules:
+  # The topology provider (rack awareness) running inside HDFS pods queries pod, node, and
+  # endpoint information to compute rack labels for DataNodes.
+  # - pods: discover pod-to-node assignment for topology calculation; watched by pod informer
+  # - nodes: read rack labels (e.g. topology.kubernetes.io/zone) from the node the pod runs on
+  # - endpoints: map service endpoints to pod IPs for topology resolution
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - nodes
+      - endpoints
+    verbs:
+      - get
+      - list
+      # needed for pod informer
+      - watch
+  # Read listener addresses so HDFS pods can resolve external access endpoints.
+  - apiGroups:
+      - listeners.stackable.tech
+    resources:
+      - listeners
+    verbs:
+      - get
+      - list
+  # Required to discover the installed CRD API version before querying listeners.
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get