OSAC-3668: grant osac-operator networkclasses RBAC for hub-access escalation

[danmanor]

OSAC-3668: Grant osac-operator networkclasses RBAC for hub-access escalation

Jira: https://redhat.atlassian.net/browse/OSAC-3668
Fixes regression from: OSAC-2352 / #111

Root cause

OSAC-2352 added subnets and networkclasses read rules to the hub-access-hosted-clusters ClusterRole but did not grant the osac-operator SA matching networkclasses permissions. The osac-operator creates per-ClusterOrder RoleBindings referencing that ClusterRole (OSAC-1121). Kubernetes RBAC escalation prevention blocked the binding — the operator SA cannot grant permissions it does not hold. Result: ClusterOrder stuck with no phase, no HostedCluster created.

Fix

• osac-operator: add networkclasses get/list/watch kubebuilder RBAC marker to clusterorder_controller.go, regenerate config/rbac/role.yaml, update Helm chart clusterrole
• bare-metal-fulfillment-operator: re-apply reverted OSAC-2352 subnets/networkclasses markers + regenerated manifests
• osac-installer: re-apply reverted OSAC-2352 subnets/networkclasses rules to hub-access-hosted-clusters ClusterRole

Testing

• make lint — 0 issues (both operators)
• make test — all pass (both operators)
• helm lint — pass (osac-installer)
• CaaS E2E should now succeed — operator can create hub-access RoleBinding without escalation denial

Summary by CodeRabbit

• Enhancements
  • Expanded platform access controls to support read-only discovery of network classes and subnets.
  • Improved operator and hosted-cluster integration with network configuration resources.
  • Controllers can now monitor network classes and subnet availability for provisioning workflows.

[openshift-ci-robot]

@danmanor: This pull request references OSAC-3668 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

OSAC-3668: Grant osac-operator networkclasses RBAC for hub-access escalation

Jira: https://redhat.atlassian.net/browse/OSAC-3668
Fixes regression from: OSAC-2352 / #111

Root cause

OSAC-2352 added subnets and networkclasses read rules to the hub-access-hosted-clusters ClusterRole but did not grant the osac-operator SA matching networkclasses permissions. The osac-operator creates per-ClusterOrder RoleBindings referencing that ClusterRole (OSAC-1121). Kubernetes RBAC escalation prevention blocked the binding — the operator SA cannot grant permissions it does not hold. Result: ClusterOrder stuck with no phase, no HostedCluster created.

Fix

• osac-operator: add networkclasses get/list/watch kubebuilder RBAC marker to clusterorder_controller.go, regenerate config/rbac/role.yaml, update Helm chart clusterrole
• bare-metal-fulfillment-operator: re-apply reverted OSAC-2352 subnets/networkclasses markers + regenerated manifests
• osac-installer: re-apply reverted OSAC-2352 subnets/networkclasses rules to hub-access-hosted-clusters ClusterRole

Testing

• make lint — 0 issues (both operators)
• make test — all pass (both operators)
• helm lint — pass (osac-installer)
• CaaS E2E should now succeed — operator can create hub-access RoleBinding without escalation denial

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danmanor

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• bare-metal-fulfillment-operator/OWNERS [danmanor]
• osac-installer/OWNERS [danmanor]
• osac-operator/OWNERS [danmanor]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Warning

Review limit reached

@danmanor, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 57 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0c8b01ff-e4bf-4400-830c-779d0b958ebf

📥 Commits

Reviewing files that changed from the base of the PR and between 18a6eb3 and 7d5a0a9.

📒 Files selected for processing (4)

• bare-metal-fulfillment-operator/charts/operator-crds/templates/osac.openshift.io_baremetalinstances.yaml
• bare-metal-fulfillment-operator/charts/operator-crds/templates/osac.openshift.io_baremetalpools.yaml
• bare-metal-fulfillment-operator/config/crd/bases/osac.openshift.io_baremetalinstances.yaml
• bare-metal-fulfillment-operator/config/crd/bases/osac.openshift.io_baremetalpools.yaml

Walkthrough

The pull request adds read-only RBAC permissions for networkclasses and subnets in the osac.openshift.io API group across both operators and hosted-cluster hub access.

Changes

Controller RBAC access

Layer / File(s)	Summary
Bare-metal controller RBAC bare-metal-fulfillment-operator/internal/controller/baremetalinstance_controller.go, bare-metal-fulfillment-operator/config/rbac/role.yaml, bare-metal-fulfillment-operator/charts/operator/templates/clusterrole.yaml	The controller markers and deployed ClusterRoles allow get, list, and watch access to networkclasses and subnets.
OSAC operator RBAC osac-operator/internal/controller/clusterorder_controller.go, osac-operator/config/rbac/role.yaml, osac-operator/charts/operator/templates/clusterrole.yaml	The controller markers and deployed ClusterRoles allow read-only access to networkclasses; controller markers also include subnets.
Hosted-cluster hub access osac-installer/charts/osac/templates/hub-access.yaml	The hub access ClusterRole allows get, list, and watch access to networkclasses and subnets.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• osac-project/osac#111: Duplicates the RBAC changes for Subnet and NetworkClass access in the same controllers and manifests.
• osac-project/osac#127: Adds a NetworkClass capabilities reconciler that requires these read permissions.
• osac-project/osac#126: Updates osac-operator controller behavior involving NetworkClass resources.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the operator RBAC change and its purpose of resolving hub-access escalation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The 47 added lines contain only RBAC rules and markers. The service-account-token Secret has no embedded data, credentials, URLs, keys, or credential literals.
No-Weak-Crypto	✅ Passed	The patch only adds Kubernetes RBAC rules and Kubebuilder markers; it introduces no weak crypto algorithms, custom crypto, or secret comparisons.
No-Injection-Vectors	✅ Passed	The diff adds only Kubernetes RBAC markers and YAML rules for read access; it contains no SQL, shell, eval/exec, pickle, unsafe YAML, or DOM injection patterns.
Container-Privileges	✅ Passed	The patch adds only ClusterRole RBAC rules and kubebuilder markers. No added line contains prohibited privilege settings; operator deployments retain runAsNonRoot and allowPrivilegeEscalation: false.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds only RBAC YAML rules and Kubebuilder comments. It adds no logging statements or sensitive-data fields.
Ai-Attribution	✅ Passed	The PR commit names Claude Code and includes an Assisted-by trailer; no AI Co-Authored-By trailer is present.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[danmanor]

/retest

[github-actions]

Re-triggered failed runs:

• E2E CaaS Full Install (#31075167688)