From 1ff14ea2521d8965b16d644076e4a1201983adf3 Mon Sep 17 00:00:00 2001 From: Martin Schuppert Date: Fri, 24 Jul 2026 15:18:49 +0200 Subject: [PATCH] Remove unnecessary pods RBAC permissions The workload rbacRules in cinder_controller.go granted the workload service account full CRUD (create/delete/get/list/patch/update/watch) on core Pods, but that service account never reads or writes Pod objects directly. Remove the unused rbacRules grant. The kubebuilder RBAC markers for pods are kept (get;list), and restored on CinderAPI, CinderBackup, CinderScheduler and CinderVolume where they were removed: lib-common's VerifyNetworkStatusFromAnnotation, called from those four controllers to verify NetworkAttachments, lists Pods using the controller-manager's own client, so the manager's ClusterRole (config/rbac/role.yaml) still needs get;list on pods. Regenerate config/rbac/role.yaml. Signed-off-by: Martin Schuppert --- config/rbac/role.yaml | 6 ++++++ internal/controller/cinder_controller.go | 6 ------ test/functional/cinder_controller_test.go | 3 +-- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 8371abb3..3f66662c 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -8,6 +8,12 @@ rules: - "" resources: - pods + verbs: + - get + - list +- apiGroups: + - "" + resources: - secrets - services verbs: diff --git a/internal/controller/cinder_controller.go b/internal/controller/cinder_controller.go index d4516e5f..2445e52f 100644 --- a/internal/controller/cinder_controller.go +++ b/internal/controller/cinder_controller.go @@ -124,7 +124,6 @@ func (r *CinderReconciler) GetLogger(ctx context.Context) logr.Logger { // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch // service account permissions that are needed to grant permission to the above // +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid;privileged,resources=securitycontextconstraints,verbs=use -// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch // Reconcile - func (r *CinderReconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ctrl.Result, _err error) { @@ -573,11 +572,6 @@ func (r *CinderReconciler) reconcileNormal(ctx context.Context, instance *cinder Resources: []string{"securitycontextconstraints"}, Verbs: []string{"use"}, }, - { - APIGroups: []string{""}, - Resources: []string{"pods"}, - Verbs: []string{"create", "get", "list", "watch", "update", "patch", "delete"}, - }, } rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules) if err != nil { diff --git a/test/functional/cinder_controller_test.go b/test/functional/cinder_controller_test.go index 171d1bdb..5d8390c7 100644 --- a/test/functional/cinder_controller_test.go +++ b/test/functional/cinder_controller_test.go @@ -182,9 +182,8 @@ var _ = Describe("Cinder controller", func() { corev1.ConditionTrue, ) role := th.GetRole(cinderTest.CinderRole) - Expect(role.Rules).To(HaveLen(2)) + Expect(role.Rules).To(HaveLen(1)) Expect(role.Rules[0].Resources).To(Equal([]string{"securitycontextconstraints"})) - Expect(role.Rules[1].Resources).To(Equal([]string{"pods"})) th.ExpectCondition( cinderName,