chore: Simplify RBAC rule comments

Author: NickLarsenNZ

deploy/helm/opensearch-operator/templates/roles.yaml

@@ -13,14 +13,7 @@ rules:
     verbs:
       - get
   # Manage core workload resources created per OpenSearchCluster.
-  # All resources are applied via Server-Side Apply (create + patch) and tracked for
-  # orphan cleanup (list + delete). The controller watches all of these via .owns() (watch).
-  # get is required by the ReconciliationPaused strategy, which calls client.get() instead
-  # of apply_patch() when reconciliation is paused.
-  # update is NOT needed: SSA uses patch (HTTP PATCH), not update (HTTP PUT).
-  # - configmaps: per-rolegroup configuration files mounted into pods
-  # - serviceaccounts: per-rolegroup ServiceAccounts for workload pods
-  # - services: per-rolegroup and discovery Services
+  # Applied via SSA, tracked for orphan cleanup, and owned by the controller.
   - apiGroups:
       - ""
     resources:
@@ -34,9 +27,8 @@ rules:
       - list
       - patch
       - watch
-  # RoleBindings bind the product ClusterRole to each per-rolegroup ServiceAccount so that
-  # workload pods have the permissions they need at runtime.
-  # Applied via SSA, tracked for orphan cleanup, and watched via .owns().
+  # RoleBinding created per role group to bind the product ClusterRole to the workload
+  # ServiceAccount. Applied via SSA, tracked for orphan cleanup, and owned by the controller.
   - apiGroups:
       - rbac.authorization.k8s.io
     resources:
@@ -48,8 +40,8 @@ rules:
       - list
       - patch
       - watch
-  # StatefulSets drive the OpenSearch node pods.
-  # Applied via SSA, tracked for orphan cleanup, and watched via .owns().
+  # StatefulSet created per role group. Applied via SSA, tracked for orphan cleanup, and
+  # owned by the controller.
   - apiGroups:
       - apps
     resources:
@@ -61,8 +53,8 @@ rules:
       - list
       - patch
       - watch
-  # PodDisruptionBudgets limit voluntary disruptions during rolling upgrades and maintenance.
-  # Applied via SSA, tracked for orphan cleanup, and watched via .owns().
+  # PodDisruptionBudget created per role group. Applied via SSA, tracked for orphan cleanup,
+  # and owned by the controller.
   - apiGroups:
       - policy
     resources:
@@ -90,9 +82,8 @@ rules:
       # Required for startup condition
       - list
       - watch
-  # Listeners (stackable-listener-operator CRD) expose OpenSearch endpoints via a
-  # cluster-level abstraction. Applied via SSA, tracked for orphan cleanup, watched via .owns().
-  # get is also used directly in dereference.rs to fetch the discovery service Listener.
+  # Listener created per role group for external access. Applied via SSA, tracked for orphan
+  # cleanup, and owned by the controller.
   - apiGroups:
       - listeners.stackable.tech
     resources:
@@ -104,18 +95,15 @@ rules:
       - list
       - patch
       - watch
-  # Events are emitted by the controller to report reconciliation results (e.g. errors,
-  # status changes) visible via kubectl describe / kubectl get events.
+  # Required to report reconciliation results and warnings back to the OpenSearchCluster object.
   - apiGroups:
       - events.k8s.io
     resources:
       - events
     verbs:
       - create
       - patch
-  # The primary CRD: the controller watches OpenSearchCluster objects to trigger reconciliation
-  # and reads them during reconcile. patch is NOT needed here — the operator only writes
-  # to the /status subresource (see rule below).
+  # Primary CRD: watched by Controller::new() and read during reconciliation.
   - apiGroups:
       - {{ include "operator.name" . }}.stackable.tech
     resources:
@@ -124,16 +112,14 @@ rules:
       - get
       - list
       - watch
-  # Status subresource: the controller calls apply_patch_status() after each reconcile to
-  # update conditions (Available, Degraded, etc.) on the OpenSearchCluster object.
+  # Status subresource: updated at the end of every reconciliation.
   - apiGroups:
       - {{ include "operator.name" . }}.stackable.tech
     resources:
       - {{ include "operator.name" . }}clusters/status
     verbs:
       - patch
-  # The operator creates per-rolegroup RoleBindings that bind the product ClusterRole to
-  # workload ServiceAccounts. bind permission on the product ClusterRole is required for that.
+  # Required to bind the product ClusterRole to the per-rolegroup ServiceAccount.
   - apiGroups:
       - rbac.authorization.k8s.io
     resources:
@@ -150,7 +136,7 @@ metadata:
   labels:
   {{- include "operator.labels" . | nindent 4 }}
 rules:
-  # OpenSearch pods emit Kubernetes Events (e.g. via the Stackable logging framework).
+  # Allows OpenSearch pods to emit Kubernetes events.
   - apiGroups:
       - events.k8s.io
     resources:
@@ -159,9 +145,7 @@ rules:
       - create
       - patch
 {{ if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
-  # Required on OpenShift: allows OpenSearch pods to run with the nonroot-v2
-  # SecurityContextConstraint, which permits running as a non-root UID without a specific
-  # seccomp profile.
+  # Required on OpenShift to allow the OpenSearch pods to run as a non-root user.
   - apiGroups:
       - security.openshift.io
     resources: