OCPBUGS-115123: Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole by isabella-janssen · Pull Request #6470 · openshift/machine-config-operator

isabella-janssen · 2026-08-31T18:02:13Z

Closes: OCPBUGS-115123

- What I did
This replaces the wildcard verb in the MachineConfigServer for the MachineConfig and MachineConfigPool resources explicitly to the necessary verbs.

- How to verify it
No functionality should be impacted, so CI tests should continue running as expected.

- Description for the changelog
OCPBUGS-115123: Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole

Summary by CodeRabbit

Security Improvements
- Restricted machine configuration access to read-only operations: get, list, and watch.
- Prevented unrestricted modification of machine configurations and machine configuration pools.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci · 2026-08-31T18:02:19Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-merge-bot · 2026-08-31T18:02:27Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

coderabbitai · 2026-08-31T18:02:37Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1b26239b-0bca-4e5c-8ef6-3ba21b1b1ec8

📥 Commits

Reviewing files that changed from the base of the PR and between e7e6abb and b764fb2.

📒 Files selected for processing (1)

manifests/machineconfigserver/clusterrole.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Walkthrough

The machine-config-server ClusterRole now grants only get, list, and watch access to machineconfigs and machineconfigpools.

Changes

Machine Config Server Permissions

Layer / File(s)	Summary
Read-only resource access `manifests/machineconfigserver/clusterrole.yaml`	The ClusterRole replaces unrestricted verbs for `machineconfigs` and `machineconfigpools` with `get`, `list`, and `watch`.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to b764f

This PR makes a single localized manifest change, and no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only `manifests/machineconfigserver/clusterrole.yaml`. It replaces `verbs: ["*"]` with `get`, `list`, and `watch`. No test files or Ginkgo title calls changed, so the cu…
Test Structure And Quality	✅ Passed	PASS. The pull request changes only `manifests/machineconfigserver/clusterrole.yaml`. The diff adds no Ginkgo test code, test paths, or test assertions. Therefore, the listed test-structure requiremen…
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only `manifests/machineconfigserver/clusterrole.yaml`, replacing `verbs: ["*"]` with `get`, `list`, and `watch`. The diff adds no Ginkgo tests, so the MicroShift test co…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS. The pull request changes only `manifests/machineconfigserver/clusterrole.yaml`, replacing wildcard RBAC verbs with `get`, `list`, and `watch`. No Ginkgo e2e tests or test files were added or mod…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only `manifests/machineconfigserver/clusterrole.yaml`, replacing `verbs: ["*"]` with `get`, `list`, and `watch`. It does not add or modify replicas, affinity, topology s…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only `manifests/machineconfigserver/clusterrole.yaml`. It replaces an RBAC wildcard with `get`, `list`, and `watch`. It adds no process-level code or stdout writes, so i…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only `manifests/machineconfigserver/clusterrole.yaml`. It adds no Ginkgo e2e tests and introduces no IPv4 assumptions or external connectivity requirements. The diff onl…
No-Weak-Crypto	✅ Passed	PASS. The verified pull-request diff changes only `manifests/machineconfigserver/clusterrole.yaml`, replacing wildcard RBAC verbs with `get`, `list`, and `watch`. The changed content contains no MD5, …
Container-Privileges	✅ Passed	The pull request changes only the ClusterRole verb from `"*"` to `"get", "list", "watch"`. It does not add `privileged`, `hostPID`, `hostNetwork`, `hostIPC`, `SYS_ADMIN`, root execution, or `allowPriv…
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The pull request changes only `manifests/machineconfigserver/clusterrole.yaml`. It replaces wildcard RBAC verbs with `get`, `list`, and `watch`. The diff adds no logging code or sensitive-data o…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the MachineConfigServer ClusterRole and the replacement of wildcard permissions with explicit verbs. It accurately summarizes the main change.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes only manifests/machineconfigserver/clusterrole.yaml. It replaces verbs: ["*"] with get, list, and watch. No test files or Ginkgo title calls changed, so the custom check has no failure condition to flag.

Full details: Test Structure And Quality

Explanation

PASS. The pull request changes only manifests/machineconfigserver/clusterrole.yaml. The diff adds no Ginkgo test code, test paths, or test assertions. Therefore, the listed test-structure requirements are not applicable.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request changes only manifests/machineconfigserver/clusterrole.yaml, replacing verbs: ["*"] with get, list, and watch. The diff adds no Ginkgo tests, so the MicroShift test compatibility check does not apply.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS. The pull request changes only manifests/machineconfigserver/clusterrole.yaml, replacing wildcard RBAC verbs with get, list, and watch. No Ginkgo e2e tests or test files were added or modified, so the SNO multi-node compatibility check does not apply.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only manifests/machineconfigserver/clusterrole.yaml, replacing verbs: ["*"] with get, list, and watch. It does not add or modify replicas, affinity, topology spread, node selectors, tolerations, or disruption budgets. The existing control-plane nodeSelector is unchanged and is not caused by this pull request.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request changes only manifests/machineconfigserver/clusterrole.yaml. It replaces an RBAC wildcard with get, list, and watch. It adds no process-level code or stdout writes, so it cannot violate the OTE binary stdout contract.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only manifests/machineconfigserver/clusterrole.yaml. It adds no Ginkgo e2e tests and introduces no IPv4 assumptions or external connectivity requirements. The diff only changes the machineconfigs and machineconfigpools verbs from "*" to "get", "list", "watch".

Full details: No-Weak-Crypto

Explanation

PASS. The verified pull-request diff changes only manifests/machineconfigserver/clusterrole.yaml, replacing wildcard RBAC verbs with get, list, and watch. The changed content contains no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto implementation, or secret/token comparison.

Full details: Container-Privileges

Explanation

The pull request changes only the ClusterRole verb from "*" to "get", "list", "watch". It does not add privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root execution, or allowPrivilegeEscalation settings. Existing hostNetwork references in the machine-config-server manifests are unchanged and are not caused by this pull request.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS. The pull request changes only manifests/machineconfigserver/clusterrole.yaml. It replaces wildcard RBAC verbs with get, list, and watch. The diff adds no logging code or sensitive-data output, and searches of the changed commit found no logging or sensitive-data terms.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

isabella-janssen · 2026-08-31T18:06:55Z

/test all

isabella-janssen · 2026-08-31T19:20:53Z

/pipeline-required

isabella-janssen · 2026-08-31T19:47:39Z

/pipeline-required

openshift-ci-robot · 2026-09-01T17:37:40Z

@isabella-janssen: This pull request references Jira Issue OCPBUGS-115123, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @sergiordlr

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Closes: OCPBUGS-115123

- What I did
This replaces the wildcard verb in the MachineConfigServer for the MachineConfig and MachineConfigPool resources explicitly to the necessary verbs.

- How to verify it
No functionality should be impacted, so CI tests should continue running as expected.

- Description for the changelog
OCPBUGS-115123: Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole

Summary by CodeRabbit

Security Improvements

Restricted machine configuration access to read-only operations: get, list, and watch.

Prevented unrestricted modification of machine configurations and machine configuration pools.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

isabella-janssen · 2026-09-01T19:40:27Z

/pipeline required

openshift-merge-bot · 2026-09-01T19:40:30Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-ocl-part1
/test e2e-gcp-op-ocl-part2
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift
/test tls-pqc-readiness

openshift-ci · 2026-09-02T00:04:03Z

@isabella-janssen: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/perfscale-control-plane-6nodes	`b764fb2`	link	false	`/test perfscale-control-plane-6nodes`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

proietfb · 2026-09-02T12:30:02Z

/lgtm

openshift-merge-bot · 2026-09-02T12:30:34Z

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

openshift-ci · 2026-09-02T12:30:38Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: isabella-janssen, proietfb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [isabella-janssen,proietfb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ptalgulk01 · 2026-09-03T07:59:36Z

Deployed below CI longduration jobs:
AWS — fips-proxy-longduration

vSphere — tp-longduration

Update- None of the failures are caused by this PR's change. They fall into a few known failures.

ptalgulk01 · 2026-09-04T07:45:22Z

/verified @ptalgulk01
/label qe-approved

openshift-ci-robot · 2026-09-04T07:45:25Z

@ptalgulk01: The /verified command must be used with one of the following actions: by, later, remove, or bypass. See https://docs.ci.openshift.org/docs/architecture/jira/#premerge-verification for more information.

Details

In response to this:

None of the failures are caused by this PR's change. They fall into a few known failures.

/verified @ptalgulk01
/label qe-approved

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-09-04T07:45:28Z

@isabella-janssen: This pull request references Jira Issue OCPBUGS-115123, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @sergiordlr

Details

In response to this:

Closes: OCPBUGS-115123

- What I did
This replaces the wildcard verb in the MachineConfigServer for the MachineConfig and MachineConfigPool resources explicitly to the necessary verbs.

- How to verify it
No functionality should be impacted, so CI tests should continue running as expected.

- Description for the changelog
OCPBUGS-115123: Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole

Summary by CodeRabbit

Security Improvements

Restricted machine configuration access to read-only operations: get, list, and watch.

Prevented unrestricted modification of machine configurations and machine configuration pools.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ptalgulk01 · 2026-09-04T07:46:20Z

/verified by @ptalgulk01

openshift-ci-robot · 2026-09-04T07:46:34Z

@ptalgulk01: This PR has been marked as verified by @ptalgulk01.

Details

In response to this:

/verified by @ptalgulk01

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-09-04T08:26:03Z

@isabella-janssen: Jira Issue Verification Checks: Jira Issue OCPBUGS-115123
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-115123 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Closes: OCPBUGS-115123

- What I did
This replaces the wildcard verb in the MachineConfigServer for the MachineConfig and MachineConfigPool resources explicitly to the necessary verbs.

- How to verify it
No functionality should be impacted, so CI tests should continue running as expected.

- Description for the changelog
OCPBUGS-115123: Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole

Summary by CodeRabbit

Security Improvements

Restricted machine configuration access to read-only operations: get, list, and watch.

Prevented unrestricted modification of machine configurations and machine configuration pools.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-merge-robot · 2026-09-04T19:38:41Z

Fix included in release 5.1.0-0.nightly-2026-09-04-115839

isabella-janssen · 2026-09-08T16:42:46Z

/cherrypick release-5.0 release-4.22 release-4.21 release-4.20 release-4.19 release-4.18

openshift-cherrypick-robot · 2026-09-08T16:43:43Z

@isabella-janssen: new pull request created: #6514

Details

In response to this:

/cherrypick release-5.0 release-4.22 release-4.21 release-4.20 release-4.19 release-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

mcs: replace wildcard permissions with explicit verbs

b764fb2

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 31, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 31, 2026

isabella-janssen changed the title ~~(WIP) OCPBUGS-115123~~ OCPBUGS-115123: Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole Sep 1, 2026

openshift-ci Bot requested a review from sergiordlr September 1, 2026 17:37

isabella-janssen marked this pull request as ready for review September 1, 2026 20:56

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 1, 2026

openshift-ci Bot requested review from pablintino and yuqi-zhang September 1, 2026 20:57

openshift-ci Bot assigned proietfb Sep 2, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Sep 2, 2026

openshift-ci Bot added the qe-approved Signifies that QE has signed off on this PR label Sep 4, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Sep 4, 2026

openshift-merge-bot Bot merged commit 91960cf into openshift:main Sep 4, 2026
18 of 19 checks passed

isabella-janssen deleted the scope-mcs-clusterrole branch September 8, 2026 16:42

openshift-cherrypick-robot mentioned this pull request Sep 8, 2026

[release-5.0] OCPBUGS-121942: Replace wildcard permissions with explicit verbs in MachineConfigServer ClusterRole #6514

Open

Uh oh!

Conversation

isabella-janssen commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci Bot commented Aug 31, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 31, 2026

Uh oh!

coderabbitai Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

isabella-janssen commented Aug 31, 2026

Uh oh!

isabella-janssen commented Aug 31, 2026

Uh oh!

isabella-janssen commented Aug 31, 2026

Uh oh!

openshift-ci-robot commented Sep 1, 2026

Summary by CodeRabbit

Uh oh!

isabella-janssen commented Sep 1, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 1, 2026

Uh oh!

openshift-ci Bot commented Sep 2, 2026

Uh oh!

proietfb commented Sep 2, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 2, 2026

Uh oh!

openshift-ci Bot commented Sep 2, 2026

Uh oh!

ptalgulk01 commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ptalgulk01 commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Sep 4, 2026

Uh oh!

openshift-ci-robot commented Sep 4, 2026

Summary by CodeRabbit

Uh oh!

ptalgulk01 commented Sep 4, 2026

Uh oh!

openshift-ci-robot commented Sep 4, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Sep 4, 2026

Summary by CodeRabbit

Uh oh!

openshift-merge-robot commented Sep 4, 2026

Uh oh!

isabella-janssen commented Sep 8, 2026

Uh oh!

openshift-cherrypick-robot commented Sep 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

isabella-janssen commented Aug 31, 2026 •

edited

Loading

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading

ptalgulk01 commented Sep 3, 2026 •

edited

Loading

ptalgulk01 commented Sep 4, 2026 •

edited

Loading