[WIP] OCPCLOUD-3557: split capi-controllers and machine-api-migration - #622
[WIP] OCPCLOUD-3557: split capi-controllers and machine-api-migration#622stefanonardo wants to merge 4 commits into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
@stefanonardo: This pull request references OCPCLOUD-3557 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (16)
💤 Files with no reviewable changes (4)
🚧 Files skipped from review as they are similar to previous changes (11)
WalkthroughThe change separates ChangesMachine API migration separation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant machine-api-migration
participant machine-api-migration-metrics
participant ServiceMonitor
machine-api-migration->>machine-api-migration-metrics: Expose HTTPS metrics on port 8443
ServiceMonitor->>machine-api-migration-metrics: Select migration metrics Service
ServiceMonitor->>machine-api-migration-metrics: Scrape metrics with TLS
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
/test e2e-aws-capi-techpreview |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/rbac.md`:
- Around line 41-43: The RBAC summary for the `machine-api-migration` Role in
`openshift-cluster-api` is mislabeled as “(read)” even though the manifest
grants both read and write verbs. Update the description in `docs/rbac.md` to
reflect the actual permissions from
`0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml`, using the
`machine-api-migration` Role entry and its Machine/MachineSet permissions as the
reference point.
In `@manifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml`:
- Around line 26-69: The machine-api-migration Deployment container spec is
missing required hardening and health settings. Update the machine-api-migration
pod/container spec to add an explicit securityContext with
readOnlyRootFilesystem, allowPrivilegeEscalation disabled, and capabilities
dropping all, and set automountServiceAccountToken to false if the controller
does not need the token. Also add resource limits alongside the existing
requests, and define livenessProbe and readinessProbe for the healthz endpoint
exposed by the machine-api-migration container on port 9440.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: af553a64-1e21-4c5f-92f4-9de4822110af
📒 Files selected for processing (12)
docs/rbac.mdmanifests/0000_30_cluster-api_02_machine-api-migration-service-account.yamlmanifests/0000_30_cluster-api_03_machine-api-migration-rbac-roles.yamlmanifests/0000_30_cluster-api_03_rbac_roles.yamlmanifests/0000_30_cluster-api_04_machine-api-migration-rbac-bindings.yamlmanifests/0000_30_cluster-api_10_capi-controllers-servicemonitor.yamlmanifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yamlmanifests/0000_30_cluster-api_10_machine-api-migration-servicemonitor.yamlmanifests/0000_30_cluster-api_10_metrics-service.yamlmanifests/0000_30_cluster-api_12_allow-ingress-to-metrics-operators.yamlmanifests/0000_30_cluster-api_17_deployment.yamlmanifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml
💤 Files with no reviewable changes (1)
- manifests/0000_30_cluster-api_10_capi-controllers-servicemonitor.yaml
| spec: | ||
| serviceAccountName: machine-api-migration | ||
| containers: | ||
| - name: machine-api-migration | ||
| image: registry.ci.openshift.org/openshift:cluster-capi-operator | ||
| command: | ||
| - /machine-api-migration | ||
| args: | ||
| - --diagnostics-address=:8443 | ||
| env: | ||
| - name: RELEASE_VERSION | ||
| value: "0.0.1-snapshot" | ||
| ports: | ||
| - containerPort: 8443 | ||
| name: diagnostics | ||
| protocol: TCP | ||
| - containerPort: 9440 | ||
| name: healthz | ||
| protocol: TCP | ||
| resources: | ||
| requests: | ||
| cpu: 10m | ||
| memory: 50Mi | ||
| terminationMessagePolicy: FallbackToLogsOnError | ||
| volumeMounts: | ||
| - name: metrics-cert | ||
| mountPath: /tmp/k8s-metrics-server/serving-certs | ||
| readOnly: true | ||
| nodeSelector: | ||
| node-role.kubernetes.io/control-plane: "" | ||
| priorityClassName: system-cluster-critical | ||
| restartPolicy: Always | ||
| tolerations: | ||
| - key: "node-role.kubernetes.io/master" | ||
| operator: "Exists" | ||
| effect: "NoSchedule" | ||
| - key: "node-role.kubernetes.io/control-plane" | ||
| operator: "Exists" | ||
| effect: "NoSchedule" | ||
| volumes: | ||
| - name: metrics-cert | ||
| secret: | ||
| defaultMode: 420 | ||
| secretName: machine-api-migration-metrics-tls |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Add explicit securityContext, resource limits, and probes to the container spec.
This new Deployment lacks:
- Pod/container
securityContext(readOnlyRootFilesystem: true,allowPrivilegeEscalation: false,capabilities.drop: ["ALL"]). Noterestricted-v2SCC (referenced via theopenshift.io/required-scc: restricted-v2annotation) already drops all capabilities and disallows privilege escalation by default, but it does not enforcereadOnlyRootFilesystem, so this must be set explicitly. resources.limits(onlyrequestsare set).livenessProbe/readinessProbe, despite exposing ahealthzport on 9440.automountServiceAccountToken: false(unless the controller genuinely needs the projected SA token via the pod itself rather than client libraries).
Static analysis flags the missing root-fs/security-context settings (Checkov CKV_K8S_20/CKV_K8S_23, Trivy KSV-0014/KSV-0118).
As per path instructions: "securityContext: runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation: false", "Drop ALL capabilities, add only what is required", "Resource limits (cpu, memory) on every container", "Liveness + readiness probes defined", "automountServiceAccountToken: false unless needed".
🛡️ Proposed fix
spec:
serviceAccountName: machine-api-migration
+ automountServiceAccountToken: false
containers:
- name: machine-api-migration
image: registry.ci.openshift.org/openshift:cluster-capi-operator
command:
- /machine-api-migration
args:
- --diagnostics-address=:8443
env:
- name: RELEASE_VERSION
value: "0.0.1-snapshot"
ports:
- containerPort: 8443
name: diagnostics
protocol: TCP
- containerPort: 9440
name: healthz
protocol: TCP
resources:
requests:
cpu: 10m
memory: 50Mi
+ limits:
+ cpu: 100m
+ memory: 100Mi
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ capabilities:
+ drop:
+ - ALL
+ livenessProbe:
+ httpGet:
+ path: /healthz
+ port: healthz
+ readinessProbe:
+ httpGet:
+ path: /readyz
+ port: healthz
terminationMessagePolicy: FallbackToLogsOnError🧰 Tools
🪛 Checkov (3.3.2)
[medium] 2-69: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[medium] 2-69: Minimize the admission of root containers
(CKV_K8S_23)
🪛 Trivy (0.69.3)
[error] 29-53: Root file system is not read-only
Container 'machine-api-migration' of Deployment 'machine-api-migration' should set 'securityContext.readOnlyRootFilesystem' to true
Rule: KSV-0014
(IaC/Kubernetes)
[error] 29-53: Default security context configured
container machine-api-migration in openshift-cluster-api namespace is using the default security context
Rule: KSV-0118
(IaC/Kubernetes)
[error] 26-69: Default security context configured
deployment machine-api-migration in openshift-cluster-api namespace is using the default security context, which allows root privileges
Rule: KSV-0118
(IaC/Kubernetes)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@manifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml`
around lines 26 - 69, The machine-api-migration Deployment container spec is
missing required hardening and health settings. Update the machine-api-migration
pod/container spec to add an explicit securityContext with
readOnlyRootFilesystem, allowPrivilegeEscalation disabled, and capabilities
dropping all, and set automountServiceAccountToken to false if the controller
does not need the token. Also add resource limits alongside the existing
requests, and define livenessProbe and readinessProbe for the healthz endpoint
exposed by the machine-api-migration container on port 9440.
Sources: Path instructions, Linters/SAST tools
|
/retest |
|
@stefanonardo: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
manifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yaml (1)
12-20: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winRemove the ineffective
targetPortmapping for this headless Service.With
clusterIP: None, Kubernetes ignorestargetPort; the Service port must already match the pod’s listening port. Keep the migration listener on8443and omittargetPort, or use a non-headless Service if named port remapping is required. (kubernetes.io)Suggested cleanup
- name: machine-api-migration-metrics port: 8443 - targetPort: diagnostics🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@manifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yaml` around lines 12 - 20, Update the Service definition for machine-api-migration-metrics by removing the targetPort mapping while retaining port 8443 and clusterIP: None, so the headless Service uses the pod’s listening port directly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@manifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml`:
- Around line 54-55: Remove the control-plane nodeSelector entry from the
Deployment manifest, leaving only topology-neutral scheduling rules so the
workload can schedule on HyperShift.
In `@ocp-manifests-input/default/capi-controllers-deployment.yaml`:
- Around line 39-42: Update the generated capi-operator manifests.yaml to
replace the outdated diagnostics-o and healthz-o port references with the
renamed diagnostics and healthz names, matching the source deployment manifest
while preserving the existing port configuration.
---
Nitpick comments:
In `@manifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yaml`:
- Around line 12-20: Update the Service definition for
machine-api-migration-metrics by removing the targetPort mapping while retaining
port 8443 and clusterIP: None, so the headless Service uses the pod’s listening
port directly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 128a92f8-b856-4904-bd2c-21119a1479de
📒 Files selected for processing (12)
docs/rbac.mdmanifests/0000_30_cluster-api_02_machine-api-migration-service-account.yamlmanifests/0000_30_cluster-api_03_machine-api-migration-rbac-roles.yamlmanifests/0000_30_cluster-api_03_rbac_roles.yamlmanifests/0000_30_cluster-api_04_machine-api-migration-rbac-bindings.yamlmanifests/0000_30_cluster-api_10_capi-controllers-servicemonitor.yamlmanifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yamlmanifests/0000_30_cluster-api_10_machine-api-migration-servicemonitor.yamlmanifests/0000_30_cluster-api_10_metrics-service.yamlmanifests/0000_30_cluster-api_12_allow-ingress-to-metrics-operators.yamlmanifests/0000_30_cluster-api_17_machine-api-migration-deployment.yamlocp-manifests-input/default/capi-controllers-deployment.yaml
🚧 Files skipped from review as they are similar to previous changes (8)
- manifests/0000_30_cluster-api_02_machine-api-migration-service-account.yaml
- manifests/0000_30_cluster-api_10_machine-api-migration-servicemonitor.yaml
- manifests/0000_30_cluster-api_10_metrics-service.yaml
- manifests/0000_30_cluster-api_10_capi-controllers-servicemonitor.yaml
- manifests/0000_30_cluster-api_04_machine-api-migration-rbac-bindings.yaml
- docs/rbac.md
- manifests/0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml
- manifests/0000_30_cluster-api_03_rbac_roles.yaml
| nodeSelector: | ||
| node-role.kubernetes.io/control-plane: "" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Remove the control-plane node selector.
This hard requirement prevents the Deployment from scheduling on HyperShift, where these nodes are not available to this workload. Keep only topology-neutral scheduling rules unless this manifest is conditionally excluded for HyperShift.
Proposed fix
- nodeSelector:
- node-role.kubernetes.io/control-plane: ""As per coding guidelines: “nodeSelector/affinity targeting control-plane nodes (breaks on HyperShift).”
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| nodeSelector: | |
| node-role.kubernetes.io/control-plane: "" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@manifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml`
around lines 54 - 55, Remove the control-plane nodeSelector entry from the
Deployment manifest, leaving only topology-neutral scheduling rules so the
workload can schedule on HyperShift.
Source: Coding guidelines
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@manifests/0000_30_cluster-api_14_allow-egress-operators.yaml`:
- Line 29: Replace the unrestricted egress rule in the machine-api-migration
egress policy with a port-based rule that allows only Kubernetes API server
access. Find the `- {}` entry in the machine-api-migration egress rules and
replace it with the same API-server port rule used by the compatibility operator
elsewhere in this manifest to ensure consistent and restrictive egress control.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 3d068657-10d3-4b28-8fa1-d67934bd8400
📒 Files selected for processing (5)
cmd/capi-controllers/main.godocs/rbac.mdmanifests/0000_30_cluster-api_03_rbac_roles.yamlmanifests/0000_30_cluster-api_04_rbac_bindings.yamlmanifests/0000_30_cluster-api_14_allow-egress-operators.yaml
💤 Files with no reviewable changes (3)
- cmd/capi-controllers/main.go
- manifests/0000_30_cluster-api_04_rbac_bindings.yaml
- manifests/0000_30_cluster-api_03_rbac_roles.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- docs/rbac.md
| operator: In | ||
| values: | ||
| - capi-controllers | ||
| - machine-api-migration |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 10 \
'allow-egress-operators|machine-api-migration|ServiceMonitor|https?://|RESTConfig|New.*Client|DialContext' \
manifests cmdRepository: openshift/cluster-capi-operator
Length of output: 50387
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- NetworkPolicy ---'
sed -n '1,80p' manifests/0000_30_cluster-api_14_allow-egress-operators.yaml
printf '%s\n' '--- migration entrypoint and controller wiring ---'
sed -n '150,280p' cmd/machine-api-migration/main.go
rg -n -g '*.go' \
'NewForConfig|NewController|SetupWithManager|GetConfig|RESTMapper|rest\.|http\.|net\.|Dial|cloud|Provider|client\.New|Get\(|List\(|Watch\(' \
cmd/machine-api-migration pkg/controllers/machinemigration pkg/controllers/machinesetmigration pkg/controllers/machinesetsync pkg/controllers/machinesyncRepository: openshift/cluster-capi-operator
Length of output: 41723
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- manager setup ---'
sed -n '60,155p' cmd/machine-api-migration/main.go
printf '%s\n' '--- direct non-test imports and network-like calls ---'
python3 - <<'PY'
from pathlib import Path
roots = [
Path("cmd/machine-api-migration"),
Path("pkg/controllers/machinemigration"),
Path("pkg/controllers/machinesetmigration"),
Path("pkg/controllers/machinesetsync"),
Path("pkg/controllers/machinesync"),
]
for root in roots:
for p in sorted(root.rglob("*.go")):
if p.name.endswith("_test.go"):
continue
text = p.read_text()
imports = []
in_import = False
for line in text.splitlines():
s = line.strip()
if s == "import (":
in_import = True
continue
if in_import and s == ")":
in_import = False
continue
if in_import or s.startswith("import "):
imports.append(s)
calls = [
(i + 1, line.strip())
for i, line in enumerate(text.splitlines())
if any(x in line for x in (
"http.", "https://", "net.", "Dial", "NewForConfig",
"RESTClient", "HTTPClient", "url.", "tls.", "cloud",
))
]
if imports or calls:
print(f"\nFILE {p}")
for line in imports:
print("IMPORT", line)
for line_no, line in calls:
print(f"CALLLIKE {line_no}: {line}")
PY
printf '%s\n' '--- related egress policies ---'
for f in manifests/0000_30_cluster-api_13_allow-egress-controllers.yaml \
manifests/0000_30_cluster-api_15_default-deny.yaml; do
if test -f "$f"; then
sed -n '1,120p' "$f"
fi
doneRepository: openshift/cluster-capi-operator
Length of output: 19627
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- shared manager and infrastructure helpers ---'
rg -n -C 8 \
'func InitOperatorConfig|func GetInfra|func GetCAPITypesForInfrastructure|NewManager|Webhook|healthz|metrics' \
pkg cmd/machine-api-migration
printf '%s\n' '--- all NetworkPolicy egress rules in the repository ---'
python3 - <<'PY'
from pathlib import Path
for p in sorted(Path("manifests").glob("*.y*ml")):
text = p.read_text()
if "kind: NetworkPolicy" in text and ("egress:" in text or "policyTypes:" in text):
print(f"\nFILE {p}")
lines = text.splitlines()
for i, line in enumerate(lines):
if line.lstrip().startswith("egress:") or line.lstrip().startswith("policyTypes:"):
print(f"{i+1}: {line}")
for j in range(i + 1, min(i + 12, len(lines))):
if lines[j].startswith("apiVersion:") or lines[j].lstrip().startswith("podSelector:"):
break
print(f"{j+1}: {lines[j]}")
PYRepository: openshift/cluster-capi-operator
Length of output: 50388
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- helper definitions ---'
rg -l 'func InitOperatorConfig|func GetInfra|func GetCAPITypesForInfrastructure' pkg cmd \
| while read -r f; do
printf '\nFILE %s\n' "$f"
rg -n -A 35 -B 3 \
'func InitOperatorConfig|func GetInfra|func GetCAPITypesForInfrastructure' "$f"
done
printf '%s\n' '--- migration production files with HTTP or network packages ---'
python3 - <<'PY'
from pathlib import Path
needles = (
'"net"', '"net/http"', '"net/url"', '"crypto/tls"',
'"github.com/aws/aws-sdk-go', '"github.com/gophercloud',
'"cloud.google.com"', '"google.golang.org/api"',
)
for p in sorted(Path("cmd/machine-api-migration").rglob("*.go")) + \
sorted(Path("pkg/controllers").rglob("*.go")):
if p.name.endswith("_test.go"):
continue
lines = p.read_text().splitlines()
hits = [(i + 1, line.strip()) for i, line in enumerate(lines)
if any(n in line for n in needles)]
if hits:
print(f"\nFILE {p}")
for n, line in hits:
print(f"{n}: {line}")
PY
printf '%s\n' '--- targeted policy files ---'
find manifests -maxdepth 1 -type f \( -name '*egress*.yaml' -o -name '*egress*.yml' \) -print \
| sort \
| while read -r f; do
printf '\nFILE %s\n' "$f"
sed -n '1,100p' "$f"
doneRepository: openshift/cluster-capi-operator
Length of output: 11903
Restrict machine-api-migration egress to the Kubernetes API server.
The migration process only uses Kubernetes API clients. It has no external cloud-provider or network client. Replace the unrestricted - {} rule with the API-server port rule used by the compatibility operator.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@manifests/0000_30_cluster-api_14_allow-egress-operators.yaml` at line 29,
Replace the unrestricted egress rule in the machine-api-migration egress policy
with a port-based rule that allows only Kubernetes API server access. Find the
`- {}` entry in the machine-api-migration egress rules and replace it with the
same API-server port rule used by the compatibility operator elsewhere in this
manifest to ensure consistent and restrictive egress control.
| | `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers` | `openshift-cluster-api` | CAPI Cluster + infra cluster resources, secrets, pod self-read, events, leases | | ||
| | `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers` | `openshift-machine-api` | MAPI machines (read-only for InfraCluster), controlplanemachinesets (InfraCluster), secrets (read-only) | | ||
| | `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers-kube-system` | `kube-system` | Secrets (vSphere credentials) | | ||
| | `0000_30_cluster-api_03_rbac_roles.yaml` | Role `cluster-capi-operator-pull-secret` | `openshift-config` | Pull-secret read | |
There was a problem hiding this comment.
cluster-capi-operator-pull-secret role and related resources removed. I can't find them used anywhere.
They were added in a61882d#diff-b259f954d26aaa43aa09f0fbc1c7af8f00d361b3122c70a2052b09ea91e5aaccR45
Separate the two binaries into independent Deployments with dedicated ServiceAccounts and least-privilege RBAC. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
3 participants
Summary
capi-controllersDeployment (two containers sharing one SA) into two independent Deployments with dedicated ServiceAccounts and least-privilege RBAC:8443(matching all other binaries)Test plan
make buildpassesmake lintpasses (0 issues)make unitpasses (pre-existing crdcompatibility failures excluded)audit2rbacon CI job audit logs to confirm zero 403s for both SAs🤖 Generated with Claude Code
Summary by CodeRabbit