From 727e8f7b5be0cfc2780a4b76d42b16c985c948e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Szil=C3=A1rd=20Guba?= <szigmon@redhat.com>
Date: Tue, 30 Jun 2026 15:01:48 +0300
Subject: [PATCH] fix: Add missing SCC bindings for controller managers

Controllers dpuservice-controller-manager and static-cm-controller-manager
fail on OpenShift due to missing privileged SCC permissions for user 65532.

Tested on OpenShift 4.22 with DPF v26.4.1-beta.1.
---
 .../privileged-scc-cluster-role-binding.yaml  | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/deploy/charts/dpf-operator/templates/openshift/privileged-scc-cluster-role-binding.yaml b/deploy/charts/dpf-operator/templates/openshift/privileged-scc-cluster-role-binding.yaml
index 985d12736..8b1f9b20e 100644
--- a/deploy/charts/dpf-operator/templates/openshift/privileged-scc-cluster-role-binding.yaml
+++ b/deploy/charts/dpf-operator/templates/openshift/privileged-scc-cluster-role-binding.yaml
@@ -68,4 +68,40 @@ subjects:
     name: dpf-provisioning-dms-service-account
     namespace: {{  .Release.Namespace }}
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: dpf-operator
+    app.kubernetes.io/part-of: dpf-operator
+    dpu.nvidia.com/component: dpuservice-controller-manager
+  name: dpuservice-scc-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:privileged
+subjects:
+  - kind: ServiceAccount
+    name: dpuservice-controller-manager
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: dpf-operator
+    app.kubernetes.io/part-of: dpf-operator
+    dpu.nvidia.com/component: static-cm-controller-manager
+  name: static-cm-scc-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:privileged
+subjects:
+  - kind: ServiceAccount
+    name: static-cm-controller-manager
+    namespace: {{ .Release.Namespace }}
+---
 {{ end }}
\ No newline at end of file