Fix and remove redundant RBAC markers for secrets and volumes <JIRA:OSPRH-34265>

[mumesan]

Description:

Secret finalizers only need update, patch verbs so everything else was removed. Also removed the non-existent volumes marker.

JIRA: OSPRH-34265

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: b94e4a8e-51f7-455b-81e1-457a89357911

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 5f840c85-bf3f-47db-8292-f9cd1bbbf39c

📥 Commits

Reviewing files that changed from the base of the PR and between 6ad9272 and 3854bf6.

📒 Files selected for processing (3)

• config/rbac/role.yaml
• internal/controller/openstackbaremetalset_controller.go
• internal/controller/openstackprovisionserver_controller.go

💤 Files with no reviewable changes (1)

• internal/controller/openstackprovisionserver_controller.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Security Improvements
  • Reduced the permissions required to manage Kubernetes Secrets.
  • Removed unnecessary access to Secret listing and watching.
  • Restricted Secret finalizer operations to updates and patches.
  • Removed unnecessary access to core volumes.

Walkthrough

The pull request narrows Kubernetes RBAC permissions. Secret access uses dedicated rules with limited verbs, and unused volume access is removed from the ClusterRole and controller declarations.

Changes

RBAC permission reduction

Layer / File(s)	Summary
ClusterRole permission separation config/rbac/role.yaml	The manager-role removes secrets, secrets/finalizers, and volumes from the shared rule. Dedicated Secret rules allow only the specified Secret and finalizer verbs.
Controller RBAC alignment internal/controller/openstackbaremetalset_controller.go, internal/controller/openstackprovisionserver_controller.go	The controller declarations remove Secret list and watch access, restrict finalizer verbs, and remove core volume access.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 3854b

This change removes redundant secret permissions and a non-existent volume marker; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: stuggi

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	The description links to JIRA issue OSPRH-34265, which matches the stated RBAC changes.
Out of Scope Changes check	✅ Passed	All changes address the stated removal of redundant Secret and volume RBAC permissions.
Title check	✅ Passed	The title clearly identifies the RBAC changes for secrets and volumes, which are the main changes in the pull request.
Description check	✅ Passed	The description accurately covers the removal of unnecessary secret finalizer verbs and the non-existent volumes marker.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/63962fbab64247bba32e781098d8cad6

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 02m 17s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal NODE_FAILURE Node(set) request 099-0000174751 failed in 0s
❌ openstack-baremetal-operator-edpm-baremetal-minor-update FAILURE in 1h 27m 48s

[mumesan]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/a495aa2254024811965385a907c3c88b

✔️ openstack-baremetal-operator-content-provider SUCCESS in 34m 10s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal NODE_FAILURE Node(set) request 099-0000174961 failed in 0s
❌ openstack-baremetal-operator-edpm-baremetal-minor-update NODE_FAILURE Node(set) request 099-0000174962 failed in 0s

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mumesan, steveb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [steveb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[steveb]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/616851bd736d46909edacfc2f083ddee

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 36m 04s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal RETRY_LIMIT Host unreachable in 1h 11m 51s
✔️ openstack-baremetal-operator-edpm-baremetal-minor-update SUCCESS in 2h 18m 08s

[mumesan]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/501c0941beb046c9959369c0a9f535d9

✔️ openstack-baremetal-operator-content-provider SUCCESS in 21m 14s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal NODE_FAILURE Node(set) request 099-0000176618 failed in 0s
❌ openstack-baremetal-operator-edpm-baremetal-minor-update NODE_FAILURE Node(set) request 099-0000176619 failed in 0s

[mumesan]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/d09d760376f94c8bbfe2622e7f6891e6

✔️ openstack-baremetal-operator-content-provider SUCCESS in 1h 39m 44s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal RETRY_LIMIT Host unreachable in 1h 22m 13s
❌ openstack-baremetal-operator-edpm-baremetal-minor-update FAILURE in 43m 46s

[mumesan]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/0484b4a54db748aa9c0f477c12d1d9f1

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 42m 14s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal RETRY_LIMIT Host unreachable in 1h 18m 01s
✔️ openstack-baremetal-operator-edpm-baremetal-minor-update SUCCESS in 2h 21m 56s

[mumesan]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/8211c6cdea364d9da8a7d7d7d471e66e

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 31m 14s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal RETRY_LIMIT Host unreachable in 1h 10m 56s
✔️ openstack-baremetal-operator-edpm-baremetal-minor-update SUCCESS in 2h 13m 50s

[mumesan]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/f8180f7b866e411ab9f8a4c36da4824a

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 40m 05s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal RETRY_LIMIT Host unreachable in 1h 19m 29s
❌ openstack-baremetal-operator-edpm-baremetal-minor-update FAILURE in 2h 22m 51s

[mumesan]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/fbf575a562aa465eb214dfb7fea78551

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 45m 25s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal RETRY_LIMIT Host unreachable in 1h 17m 01s
✔️ openstack-baremetal-operator-edpm-baremetal-minor-update SUCCESS in 2h 25m 19s

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/4d5036500ab04ca184d84a5077231e0e

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 59m 59s
✔️ openstack-baremetal-operator-crc-podified-edpm-baremetal SUCCESS in 1h 41m 59s
❌ openstack-baremetal-operator-edpm-baremetal-minor-update NODE_FAILURE Node(set) request 099-0000181252 failed in 0s

[mumesan]

/retest

[mumesan]

looks like the test failure is in diagnostics collection and unrelated to the contents of the PR. The build also seems to have failed before running - ❌ [openstack-baremetal-operator-edpm-baremetal-minor-update ](https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/build/525141c2608c49bd972fb921d5f30b36)NODE_FAILURE Node(set) request 099-0000181252 failed in 0s, so running both retest and recheck.

[mumesan]

/retest

[mumesan]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/18a54c4ad1b6461ebab2c957f5d0cb50

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 34m 07s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal FAILURE in 38m 52s
✔️ openstack-baremetal-operator-edpm-baremetal-minor-update SUCCESS in 2h 15m 54s

[mumesan]

The failure is because of CRC errors, rechecking

[mumesan]

recheck