From 8dc812059983db76e6607e2a4da861172b0690ab Mon Sep 17 00:00:00 2001
From: Scot Wells <wells.scot@gmail.com>
Date: Thu, 1 Oct 2026 20:50:13 -0500
Subject: [PATCH] Keep IP address status under system control

---
 .../components/iam/protected-resources/ipallocation.yaml   | 7 ++++++-
 config/components/iam/protected-resources/ipclaim.yaml     | 7 ++++++-
 config/components/iam/protected-resources/ipclass.yaml     | 7 ++++++-
 config/components/iam/protected-resources/ippool.yaml      | 7 ++++++-
 config/components/iam/roles/ipam-admin.yaml                | 7 +------
 5 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/config/components/iam/protected-resources/ipallocation.yaml b/config/components/iam/protected-resources/ipallocation.yaml
index 526556e..e99a5c2 100644
--- a/config/components/iam/protected-resources/ipallocation.yaml
+++ b/config/components/iam/protected-resources/ipallocation.yaml
@@ -16,7 +16,12 @@ spec:
     - update
     - patch
     - delete
-    - updateStatus
+  subresources:
+    - name: status
+      permissions:
+        - get
+        - update
+        - patch
   parentResources:
     - apiGroup: resourcemanager.miloapis.com
       kind: Project
diff --git a/config/components/iam/protected-resources/ipclaim.yaml b/config/components/iam/protected-resources/ipclaim.yaml
index d8e6abc..c8dbd38 100644
--- a/config/components/iam/protected-resources/ipclaim.yaml
+++ b/config/components/iam/protected-resources/ipclaim.yaml
@@ -16,7 +16,12 @@ spec:
     - update
     - patch
     - delete
-    - updateStatus
+  subresources:
+    - name: status
+      permissions:
+        - get
+        - update
+        - patch
   parentResources:
     - apiGroup: resourcemanager.miloapis.com
       kind: Project
diff --git a/config/components/iam/protected-resources/ipclass.yaml b/config/components/iam/protected-resources/ipclass.yaml
index bb0fbe1..9db1303 100644
--- a/config/components/iam/protected-resources/ipclass.yaml
+++ b/config/components/iam/protected-resources/ipclass.yaml
@@ -16,11 +16,16 @@ spec:
     - update
     - patch
     - delete
-    - updateStatus
     # "use" is checked when an IPClass in another project is created with
     # spec.source naming this class (see internal/access/class.go). Granting it
     # admits that project's claims into this class's address space.
     - use
+  subresources:
+    - name: status
+      permissions:
+        - get
+        - update
+        - patch
   parentResources:
     - apiGroup: resourcemanager.miloapis.com
       kind: Project
diff --git a/config/components/iam/protected-resources/ippool.yaml b/config/components/iam/protected-resources/ippool.yaml
index 304b3fa..2b6d796 100644
--- a/config/components/iam/protected-resources/ippool.yaml
+++ b/config/components/iam/protected-resources/ippool.yaml
@@ -16,11 +16,16 @@ spec:
     - update
     - patch
     - delete
-    - updateStatus
     # "use" is the verb checked by the IPAM PoolAccessChecker (see
     # internal/access/sar.go) when a consumer claims from a shared pool.
     # Granting it on a pool implicitly authorises cross-project allocation.
     - use
+  subresources:
+    - name: status
+      permissions:
+        - get
+        - update
+        - patch
   parentResources:
     - apiGroup: resourcemanager.miloapis.com
       kind: Project
diff --git a/config/components/iam/roles/ipam-admin.yaml b/config/components/iam/roles/ipam-admin.yaml
index 89bdc68..fc4a1f8 100644
--- a/config/components/iam/roles/ipam-admin.yaml
+++ b/config/components/iam/roles/ipam-admin.yaml
@@ -9,8 +9,7 @@ spec:
   launchStage: Beta
   # Admin is the union of provider (pool CRUD + use) and consumer (claim CRUD),
   # both of which inherit viewer (reads). On top it adds full management of the
-  # system-created IPAllocation records and the status subresource on every
-  # resource type.
+  # system-created IPAllocation records. Status remains system-managed.
   inheritedRoles:
     - name: ipam.miloapis.com-provider
     - name: ipam.miloapis.com-consumer
@@ -19,7 +18,3 @@ spec:
     - ipam.miloapis.com/ipallocations.update
     - ipam.miloapis.com/ipallocations.patch
     - ipam.miloapis.com/ipallocations.delete
-    - ipam.miloapis.com/ipclasses.updateStatus
-    - ipam.miloapis.com/ippools.updateStatus
-    - ipam.miloapis.com/ipclaims.updateStatus
-    - ipam.miloapis.com/ipallocations.updateStatus