OLS-3240: Add missing RBAC markers for core API resources

[onmete]

Summary

• Added +kubebuilder:rbac markers for core Kubernetes resources (ServiceAccounts, ConfigMaps, Services, Deployments) and OpenShift resources (ConsolePlugins, Consoles) to controller/sandbox/bootstrap.go and controller/console/reconciler.go
• Widened make manifests controller-gen path from controller/proposal/... to controller/... so all controller packages are scanned
• Regenerated config/rbac/role.yaml with the complete set of permissions

Context

The generated ClusterRole in config/rbac/role.yaml was missing permissions for resources the operator creates at runtime (EnsureBaseSandboxTemplate creates ServiceAccounts, EnsureAgenticConsole creates Deployments/Services/ConfigMaps/ConsolePlugins). This was masked by cluster-admin granted via hack/agentic/deploy.sh, but would cause Forbidden errors under least-privilege RBAC.

Testing

• make vet — passed
• make api-lint — passed
• make test — passed
• make manifests — regenerated role.yaml verified
• Cluster verification — deployed operator with generated role.yaml only (no cluster-admin) on ROSA cluster, confirmed:
  • Old role.yaml: serviceaccounts is forbidden → operator crashes
  • New role.yaml: ServiceAccount ready / SandboxTemplate ready / Base SandboxTemplate bootstrap complete → operator 1/1 Running
• make test-e2e — pre-existing failures (spec.tools.skills[0].paths: Required value), unrelated to this change

Fixes: https://issues.redhat.com/browse/OLS-3240

Made with Cursor

[openshift-ci-robot]

@onmete: This pull request references OLS-3240 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Added +kubebuilder:rbac markers for core Kubernetes resources (ServiceAccounts, ConfigMaps, Services, Deployments) and OpenShift resources (ConsolePlugins, Consoles) to controller/sandbox/bootstrap.go and controller/console/reconciler.go
• Widened make manifests controller-gen path from controller/proposal/... to controller/... so all controller packages are scanned
• Regenerated config/rbac/role.yaml with the complete set of permissions

Context

The generated ClusterRole in config/rbac/role.yaml was missing permissions for resources the operator creates at runtime (EnsureBaseSandboxTemplate creates ServiceAccounts, EnsureAgenticConsole creates Deployments/Services/ConfigMaps/ConsolePlugins). This was masked by cluster-admin granted via hack/agentic/deploy.sh, but would cause Forbidden errors under least-privilege RBAC.

Testing

• make vet — passed
• make api-lint — passed
• make test — passed
• make manifests — regenerated role.yaml verified
• Cluster verification — deployed operator with generated role.yaml only (no cluster-admin) on ROSA cluster, confirmed:
• Old role.yaml: serviceaccounts is forbidden → operator crashes
• New role.yaml: ServiceAccount ready / SandboxTemplate ready / Base SandboxTemplate bootstrap complete → operator 1/1 Running
• make test-e2e — pre-existing failures (spec.tools.skills[0].paths: Required value), unrelated to this change

Fixes: https://issues.redhat.com/browse/OLS-3240

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: eaf71fd5-55fc-49d9-9215-6eb5e0e076c4

📥 Commits

Reviewing files that changed from the base of the PR and between c0bf46c and ed13f57.

⛔ Files ignored due to path filters (1)

• config/rbac/role.yaml is excluded by !config/rbac/role.yaml

📒 Files selected for processing (3)

• Makefile
• controller/console/reconciler.go
• controller/sandbox/bootstrap.go

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Enhanced operator permissions to manage additional Kubernetes resources including services, configuration maps, deployments, console plugins, and custom consoles.
  • Expanded controller configuration generation to include all controller packages.

Walkthrough

The PR expands CRD and RBAC manifest generation to include all controller packages. The Makefile manifests target now scans ./controller/... instead of only ./controller/proposal/..., and RBAC annotations have been added to the console and sandbox controllers to declare their required Kubernetes permissions.

Changes

RBAC and CRD Generation Expansion

Layer / File(s)	Summary
Manifest generation scope expansion Makefile	controller-gen paths argument changed from ./controller/proposal/... to ./controller/... to enable scanning all controller packages for CRD and RBAC generation.
Controller RBAC annotations controller/console/reconciler.go, controller/sandbox/bootstrap.go	Added kubebuilder:rbac annotations to console reconciler (service accounts, services, config maps, deployments, console plugins, consoles) and sandbox bootstrap (service account creation).

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding missing RBAC markers for core API resources, which is the primary purpose of this PR.
Description check	✅ Passed	The description clearly relates to the changeset, detailing RBAC marker additions, the Makefile path change, and testing performed against the actual problem.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign xrajesh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@onmete: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.