From 92728de58ec93f5ed3672d1c338780660abe3f15 Mon Sep 17 00:00:00 2001 From: xavier Date: Fri, 3 Jul 2026 19:36:43 -0400 Subject: [PATCH 1/2] OLS-3087: Replace wildcard RBAC verb on namespace-scoped roles/rolebindings The namespace-scoped Role in openshift-lightspeed granted verb '*' on roles and rolebindings, which implicitly includes 'escalate' and 'bind'. Replace with the explicit verbs the operator actually uses: get, list, create, update, delete. Co-Authored-By: Claude Opus 4.6 (1M context) --- config/rbac/role.yaml | 6 +++++- internal/controller/olsconfig_controller.go | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index ce15e0fe6..8c75ae425 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -207,4 +207,8 @@ rules: - rolebindings - roles verbs: - - '*' + - create + - delete + - get + - list + - update diff --git a/internal/controller/olsconfig_controller.go b/internal/controller/olsconfig_controller.go index eadfc03ea..fa7a61df3 100644 --- a/internal/controller/olsconfig_controller.go +++ b/internal/controller/olsconfig_controller.go @@ -129,7 +129,7 @@ type OLSConfigReconciler struct { // Modify console CR to activate console plugin // +kubebuilder:rbac:groups=operator.openshift.io,resources=consoles,verbs=watch;list;get;update // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings;rolebindings,verbs=get;list;create;update;patch;delete;watch -// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,namespace=openshift-lightspeed,resources=roles;rolebindings,verbs=* +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,namespace=openshift-lightspeed,resources=roles;rolebindings,verbs=get;list;create;update;delete // NonResourceURLs for Lightspeed access control and metrics // +kubebuilder:rbac:urls=/ls-access,verbs=get // +kubebuilder:rbac:urls=/ols-metrics-access,verbs=get From 9dcbe6b9b1bd9731648a4abe6b1acafef6ccc656 Mon Sep 17 00:00:00 2001 From: xavier Date: Mon, 6 Jul 2026 13:43:13 -0400 Subject: [PATCH 2/2] OLS-3087: Add missing watch and patch verbs to namespace-scoped RBAC The initial wildcard-to-explicit verb replacement omitted watch and patch, which are required by controller-runtime informers and CreateOrUpdate. Without them the operator cannot reconcile OLSConfig into a working deployment, causing all e2e tests to cascade-fail. Co-Authored-By: Claude Opus 4.6 (1M context) --- config/rbac/role.yaml | 2 ++ internal/controller/olsconfig_controller.go | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 8c75ae425..80441ddbb 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -211,4 +211,6 @@ rules: - delete - get - list + - patch - update + - watch diff --git a/internal/controller/olsconfig_controller.go b/internal/controller/olsconfig_controller.go index fa7a61df3..2acae569b 100644 --- a/internal/controller/olsconfig_controller.go +++ b/internal/controller/olsconfig_controller.go @@ -129,7 +129,7 @@ type OLSConfigReconciler struct { // Modify console CR to activate console plugin // +kubebuilder:rbac:groups=operator.openshift.io,resources=consoles,verbs=watch;list;get;update // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings;rolebindings,verbs=get;list;create;update;patch;delete;watch -// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,namespace=openshift-lightspeed,resources=roles;rolebindings,verbs=get;list;create;update;delete +// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,namespace=openshift-lightspeed,resources=roles;rolebindings,verbs=get;list;watch;create;update;patch;delete // NonResourceURLs for Lightspeed access control and metrics // +kubebuilder:rbac:urls=/ls-access,verbs=get // +kubebuilder:rbac:urls=/ols-metrics-access,verbs=get