From fc17f23b3cf3e832c58873e7cd5f6dd5d89d63ba Mon Sep 17 00:00:00 2001 From: Juan Manuel Parrilla Madrid Date: Sat, 18 Apr 2026 09:53:33 +0200 Subject: [PATCH] fix(install): add missing RBAC for webhook configurations The webhookcerts controller introduced in PR #8174 (CNTRLPLANE-2207) performs Get/Update on MutatingWebhookConfiguration and ValidatingWebhookConfiguration via the cached client, which triggers lazy informer creation requiring list/watch at cluster scope. The ClusterRole was missing these permissions, causing repeated reflector errors in the operator logs. Add a cluster-scoped RBAC rule for mutatingwebhookconfigurations and validatingwebhookconfigurations with get, list, watch, and update verbs. Closes: OCPBUGS-83751 Co-Authored-By: Claude Opus 4.6 Signed-off-by: Juan Manuel Parrilla Madrid --- cmd/install/assets/hypershift_operator.go | 5 ++++ .../assets/hypershift_operator_test.go | 27 +++++++++++++++++++ 2 files changed, 32 insertions(+) diff --git a/cmd/install/assets/hypershift_operator.go b/cmd/install/assets/hypershift_operator.go index a12384186df8..711617609b85 100644 --- a/cmd/install/assets/hypershift_operator.go +++ b/cmd/install/assets/hypershift_operator.go @@ -1482,6 +1482,11 @@ func (o HyperShiftOperatorClusterRole) Build() *rbacv1.ClusterRole { Verbs: []string{"delete"}, ResourceNames: []string{hyperv1.GroupVersion.Group}, }, + { + APIGroups: []string{"admissionregistration.k8s.io"}, + Resources: []string{"mutatingwebhookconfigurations", "validatingwebhookconfigurations"}, + Verbs: []string{"get", "list", "watch", "update"}, + }, { APIGroups: []string{"certificates.k8s.io"}, Resources: []string{"certificatesigningrequests"}, diff --git a/cmd/install/assets/hypershift_operator_test.go b/cmd/install/assets/hypershift_operator_test.go index bf9d7bbf8060..5ca4665d1a95 100644 --- a/cmd/install/assets/hypershift_operator_test.go +++ b/cmd/install/assets/hypershift_operator_test.go @@ -9,6 +9,7 @@ import ( hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" corev1 "k8s.io/api/core/v1" + rbacv1 "k8s.io/api/rbac/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) @@ -772,3 +773,29 @@ func TestHyperShiftOperatorDeployment_Build_WorkloadIdentityLabel(t *testing.T) }) } } + +func TestHyperShiftOperatorClusterRole_WebhookRBAC(t *testing.T) { + t.Parallel() + clusterRole := HyperShiftOperatorClusterRole{}.Build() + + t.Run("When building the ClusterRole it should include cluster-scoped RBAC for webhook configurations", func(t *testing.T) { + t.Parallel() + g := NewGomegaWithT(t) + g.Expect(clusterRole.Rules).To(ContainElement(Equal(rbacv1.PolicyRule{ + APIGroups: []string{"admissionregistration.k8s.io"}, + Resources: []string{"mutatingwebhookconfigurations", "validatingwebhookconfigurations"}, + Verbs: []string{"get", "list", "watch", "update"}, + }))) + }) + + t.Run("When building the ClusterRole it should include scoped delete for validatingwebhookconfigurations", func(t *testing.T) { + t.Parallel() + g := NewGomegaWithT(t) + g.Expect(clusterRole.Rules).To(ContainElement(Equal(rbacv1.PolicyRule{ + APIGroups: []string{"admissionregistration.k8s.io"}, + Resources: []string{"validatingwebhookconfigurations"}, + Verbs: []string{"delete"}, + ResourceNames: []string{hyperv1.GroupVersion.Group}, + }))) + }) +}