From 30d617270667a5e0cec5a52170c2e3af0dab989d Mon Sep 17 00:00:00 2001 From: Tom Pantelis Date: Wed, 24 Jun 2026 12:38:56 -0400 Subject: [PATCH] feat(rbac): Add HostedCluster RBAC permissions for CNO CNO needs to read hostedclusters.hypershift.openshift.io resources to fetch TLS security profile configuration from the HostedCluster spec. This was added to both the static role.yaml (for when networkType is OVNKubernetes) and the dynamic adaptRole() function (which replaces the rules otherwise). Signed-off-by: Tom Pantelis --- ...PlaneComponents_cluster_network_operator_role.yaml | 8 ++++++++ ...PlaneComponents_cluster_network_operator_role.yaml | 8 ++++++++ ...PlaneComponents_cluster_network_operator_role.yaml | 8 ++++++++ ...PlaneComponents_cluster_network_operator_role.yaml | 8 ++++++++ ...PlaneComponents_cluster_network_operator_role.yaml | 8 ++++++++ .../v2/assets/cluster-network-operator/role.yaml | 8 ++++++++ .../controllers/hostedcontrolplane/v2/cno/rbac.go | 11 +++++++++++ 7 files changed, 59 insertions(+) diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml index 8094dbe47085..6ba162c0c115 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml @@ -76,3 +76,11 @@ rules: - hostedcontrolplanes/status verbs: - '*' +- apiGroups: + - hypershift.openshift.io + resources: + - hostedclusters + verbs: + - get + - list + - watch diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml index 8094dbe47085..6ba162c0c115 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml @@ -76,3 +76,11 @@ rules: - hostedcontrolplanes/status verbs: - '*' +- apiGroups: + - hypershift.openshift.io + resources: + - hostedclusters + verbs: + - get + - list + - watch diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml index 8094dbe47085..6ba162c0c115 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml @@ -76,3 +76,11 @@ rules: - hostedcontrolplanes/status verbs: - '*' +- apiGroups: + - hypershift.openshift.io + resources: + - hostedclusters + verbs: + - get + - list + - watch diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml index 8094dbe47085..6ba162c0c115 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml @@ -76,3 +76,11 @@ rules: - hostedcontrolplanes/status verbs: - '*' +- apiGroups: + - hypershift.openshift.io + resources: + - hostedclusters + verbs: + - get + - list + - watch diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml index 8094dbe47085..6ba162c0c115 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/zz_fixture_TestControlPlaneComponents_cluster_network_operator_role.yaml @@ -76,3 +76,11 @@ rules: - hostedcontrolplanes/status verbs: - '*' +- apiGroups: + - hypershift.openshift.io + resources: + - hostedclusters + verbs: + - get + - list + - watch diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-network-operator/role.yaml b/control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-network-operator/role.yaml index 54fc9f4813ba..eb0a534ce3ae 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-network-operator/role.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-network-operator/role.yaml @@ -55,3 +55,11 @@ rules: - hostedcontrolplanes/status verbs: - '*' +- apiGroups: + - hypershift.openshift.io + resources: + - hostedclusters + verbs: + - get + - list + - watch diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/cno/rbac.go b/control-plane-operator/controllers/hostedcontrolplane/v2/cno/rbac.go index 75bdd5d9a7fd..fb6ce02dea52 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/cno/rbac.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/cno/rbac.go @@ -88,6 +88,17 @@ func adaptRole(cpContext component.WorkloadContext, role *rbacv1.Role) error { }, Verbs: []string{"*"}, }, + { + APIGroups: []string{hyperv1.GroupVersion.Group}, + Resources: []string{ + "hostedclusters", + }, + Verbs: []string{ + "get", + "list", + "watch", + }, + }, } return nil