Gathering kmm RBAC annotations in Module controller

TomerNewman · TomerNewman · commit 4e0024f64eff · 2025-05-14T14:57:30.000+03:00
Until now, RBAC annotations under
internal/controllers were scattered
across multiple controller files.
With this commit, the annotation are now
centralized only in Module controller and
MCM controller.
diff --git a/internal/controllers/build_sign_reconciler.go b/internal/controllers/build_sign_reconciler.go
@@ -64,13 +64,6 @@ func NewBuildSignReconciler(
 	}
 }
 
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch;update;patch
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules/status,verbs=get;update;patch
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=configmaps,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=pods,verbs=create;list;watch;delete
-
 // Reconcile lists all nodes and looks for kernels that match its mappings.
 // For each mapping that matches at least one node in the cluster, it creates a DaemonSet running the container image
 // on the nodes with a compatible kernel.
diff --git a/internal/controllers/device_plugin_pod_reconciler.go b/internal/controllers/device_plugin_pod_reconciler.go
@@ -18,9 +18,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 )
 
-//+kubebuilder:rbac:groups="core",resources=pods,verbs=get;patch;list;watch
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;watch
-
 const DevicePluginPodReconcilerName = "DevicePluginPod"
 
 type DevicePluginPodReconciler struct {
diff --git a/internal/controllers/device_plugin_reconciler.go b/internal/controllers/device_plugin_reconciler.go
@@ -79,12 +79,6 @@ func (r *DevicePluginReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		)
 }
 
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch;
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules/status,verbs=get;update;patch
-//+kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=create;delete;get;list;patch;watch
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch
-
 func (r *DevicePluginReconciler) Reconcile(ctx context.Context, mod *kmmv1beta1.Module) (ctrl.Result, error) {
 	res := ctrl.Result{}
 
diff --git a/internal/controllers/mbsc_reconciler.go b/internal/controllers/mbsc_reconciler.go
@@ -63,12 +63,6 @@ func (r *mbscReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		)
 }
 
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modulebuildsignconfigs,verbs=get;list;watch;update;patch;create
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modulebuildsignconfigs/status,verbs=get;update;patch
-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=configmaps,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=pods,verbs=create;list;watch;delete
-
 func (r *mbscReconciler) Reconcile(ctx context.Context, mbscObj *kmmv1beta1.ModuleBuildSignConfig) (ctrl.Result, error) {
 	res := ctrl.Result{}
 
diff --git a/internal/controllers/mic_reconciler.go b/internal/controllers/mic_reconciler.go
@@ -63,9 +63,6 @@ func (r *micReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		)
 }
 
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=moduleimagesconfigs,verbs=get;list;watch;patch;create;delete
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=moduleimagesconfigs/status,verbs=get;update;patch
-
 func (r *micReconciler) Reconcile(ctx context.Context, micObj *kmmv1beta1.ModuleImagesConfig) (ctrl.Result, error) {
 	res := ctrl.Result{}
 	if micObj.GetDeletionTimestamp() != nil {
diff --git a/internal/controllers/module_reconciler.go b/internal/controllers/module_reconciler.go
@@ -32,9 +32,25 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
 
-//+kubebuilder:rbac:groups="core",resources=namespaces,verbs=get;list;patch;watch
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;watch
+//+kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=create;delete;get;list;patch;watch
+//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,resourceNames=kernel-versions.kmm.node.kubernetes.io,verbs=delete;patch;update
+//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,verbs=create;get;list;watch
+//+kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch
+//+kubebuilder:rbac:groups=core,resources=namespaces,verbs=get;list;patch;watch
+//+kubebuilder:rbac:groups=core,resources=nodes,verbs=get;list;watch;patch
+//+kubebuilder:rbac:groups=core,resources=pods,verbs=create;delete;get;list;patch;watch
+//+kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch
+//+kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modulebuildsignconfigs,verbs=get;list;watch;update;patch;create
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modulebuildsignconfigs/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=moduleimagesconfigs,verbs=get;list;watch;patch;create;delete
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=moduleimagesconfigs/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch;update;patch
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=nodemodulesconfigs,verbs=get;list;watch;patch;create;delete
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=nodemodulesconfigs/status,verbs=patch
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=preflightvalidations,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=preflightvalidations/status,verbs=get;update;patch
 
 const (
 	ModuleReconcilerName = "ModuleReconciler"
diff --git a/internal/controllers/nmc_reconciler.go b/internal/controllers/nmc_reconciler.go
@@ -37,13 +37,6 @@ const (
 	NodeModulesConfigReconcilerName = "NodeModulesConfig"
 )
 
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=nodemodulesconfigs,verbs=get;list;watch
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=nodemodulesconfigs/status,verbs=patch
-//+kubebuilder:rbac:groups="core",resources=pods,verbs=create;delete;get;list;watch
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=serviceaccounts,verbs=get;list;watch
-
 type NMCReconciler struct {
 	client     client.Client
 	helper     nmcReconcilerHelper
diff --git a/internal/controllers/node_kernel_clusterclaim.go b/internal/controllers/node_kernel_clusterclaim.go
@@ -21,10 +21,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
 
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;patch;list;watch
-//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,verbs=create;get;list;watch
-//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,resourceNames=kernel-versions.kmm.node.kubernetes.io,verbs=delete;patch;update
-
 const (
 	NodeKernelClusterClaimReconcilerName = "NodeKernelClusterClaim"
 )
diff --git a/internal/controllers/node_label_module_version_reconciler.go b/internal/controllers/node_label_module_version_reconciler.go
@@ -16,8 +16,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
 
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;watch;patch
-
 // this struct contains all the version labels related to a specific Module
 type modulesVersionLabels struct {
 	name                     string
diff --git a/internal/controllers/preflightvalidation_reconciler.go b/internal/controllers/preflightvalidation_reconciler.go
@@ -86,10 +86,6 @@ func (r *PreflightValidationReconciler) SetupWithManager(mgr ctrl.Manager) error
 		)
 }
 
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=preflightvalidations,verbs=get;list;watch;create;update;patch;delete
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=preflightvalidations/status,verbs=get;update;patch
-
 // Reconcile Reconiliation entry point
 func (r *PreflightValidationReconciler) Reconcile(ctx context.Context, pv *v1beta2.PreflightValidation) (ctrl.Result, error) {
 	log := ctrl.LoggerFrom(ctx)

Original file line number	Diff line number	Diff line change
`@@ -64,13 +64,6 @@ func NewBuildSignReconciler(`
`64`	`64`	`}`
`65`	`65`	`}`
`66`	`66`
`67`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch;update;patch`
`68`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules/status,verbs=get;update;patch`
`69`		`-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;list;watch`
`70`		`-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch`
`71`		`-//+kubebuilder:rbac:groups="core",resources=configmaps,verbs=get;list;watch`
`72`		`-//+kubebuilder:rbac:groups="core",resources=pods,verbs=create;list;watch;delete`
`73`		`-`
`74`	`67`	`// Reconcile lists all nodes and looks for kernels that match its mappings.`
`75`	`68`	`// For each mapping that matches at least one node in the cluster, it creates a DaemonSet running the container image`
`76`	`69`	`// on the nodes with a compatible kernel.`
Original file line number	Diff line number	Diff line change
`@@ -18,9 +18,6 @@ import (`
`18`	`18`	`"sigs.k8s.io/controller-runtime/pkg/predicate"`
`19`	`19`	`)`
`20`	`20`
`21`		`-//+kubebuilder:rbac:groups="core",resources=pods,verbs=get;patch;list;watch`
`22`		`-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;watch`
`23`		`-`
`24`	`21`	`const DevicePluginPodReconcilerName = "DevicePluginPod"`
`25`	`22`
`26`	`23`	`type DevicePluginPodReconciler struct {`
Original file line number	Diff line number	Diff line change
`@@ -79,12 +79,6 @@ func (r *DevicePluginReconciler) SetupWithManager(mgr ctrl.Manager) error {`
`79`	`79`	`)`
`80`	`80`	`}`
`81`	`81`
`82`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch;`
`83`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules/status,verbs=get;update;patch`
`84`		`-//+kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=create;delete;get;list;patch;watch`
`85`		`-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;list;watch`
`86`		`-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch`
`87`		`-`
`88`	`82`	`func (r DevicePluginReconciler) Reconcile(ctx context.Context, mod kmmv1beta1.Module) (ctrl.Result, error) {`
`89`	`83`	`res := ctrl.Result{}`
`90`	`84`
Original file line number	Diff line number	Diff line change
`@@ -63,12 +63,6 @@ func (r *mbscReconciler) SetupWithManager(mgr ctrl.Manager) error {`
`63`	`63`	`)`
`64`	`64`	`}`
`65`	`65`
`66`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modulebuildsignconfigs,verbs=get;list;watch;update;patch;create`
`67`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modulebuildsignconfigs/status,verbs=get;update;patch`
`68`		`-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch`
`69`		`-//+kubebuilder:rbac:groups="core",resources=configmaps,verbs=get;list;watch`
`70`		`-//+kubebuilder:rbac:groups="core",resources=pods,verbs=create;list;watch;delete`
`71`		`-`
`72`	`66`	`func (r mbscReconciler) Reconcile(ctx context.Context, mbscObj kmmv1beta1.ModuleBuildSignConfig) (ctrl.Result, error) {`
`73`	`67`	`res := ctrl.Result{}`
`74`	`68`
Original file line number	Diff line number	Diff line change
`@@ -63,9 +63,6 @@ func (r *micReconciler) SetupWithManager(mgr ctrl.Manager) error {`
`63`	`63`	`)`
`64`	`64`	`}`
`65`	`65`
`66`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=moduleimagesconfigs,verbs=get;list;watch;patch;create;delete`
`67`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=moduleimagesconfigs/status,verbs=get;update;patch`
`68`		`-`
`69`	`66`	`func (r micReconciler) Reconcile(ctx context.Context, micObj kmmv1beta1.ModuleImagesConfig) (ctrl.Result, error) {`
`70`	`67`	`res := ctrl.Result{}`
`71`	`68`	`if micObj.GetDeletionTimestamp() != nil {`
Original file line number	Diff line number	Diff line change
`@@ -21,10 +21,6 @@ import (`
`21`	`21`	`"sigs.k8s.io/controller-runtime/pkg/reconcile"`
`22`	`22`	`)`
`23`	`23`
`24`		`-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;patch;list;watch`
`25`		`-//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,verbs=create;get;list;watch`
`26`		`-//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,resourceNames=kernel-versions.kmm.node.kubernetes.io,verbs=delete;patch;update`
`27`		`-`
`28`	`24`	`const (`
`29`	`25`	`NodeKernelClusterClaimReconcilerName = "NodeKernelClusterClaim"`
`30`	`26`	`)`
Original file line number	Diff line number	Diff line change
`@@ -16,8 +16,6 @@ import (`
`16`	`16`	`"sigs.k8s.io/controller-runtime/pkg/reconcile"`
`17`	`17`	`)`
`18`	`18`
`19`		`-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;watch;patch`
`20`		`-`
`21`	`19`	`// this struct contains all the version labels related to a specific Module`
`22`	`20`	`type modulesVersionLabels struct {`
`23`	`21`	`name string`
Original file line number	Diff line number	Diff line change
`@@ -86,10 +86,6 @@ func (r *PreflightValidationReconciler) SetupWithManager(mgr ctrl.Manager) error`
`86`	`86`	`)`
`87`	`87`	`}`
`88`	`88`
`89`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch`
`90`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=preflightvalidations,verbs=get;list;watch;create;update;patch;delete`
`91`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=preflightvalidations/status,verbs=get;update;patch`
`92`		`-`
`93`	`89`	`// Reconcile Reconiliation entry point`
`94`	`90`	`func (r PreflightValidationReconciler) Reconcile(ctx context.Context, pv v1beta2.PreflightValidation) (ctrl.Result, error) {`
`95`	`91`	`log := ctrl.LoggerFrom(ctx)`