Gathering kmm RBAC annotations in Module controller

TomerNewman · k8s-ci-robot · commit 9233136873bd · 2025-05-15T05:29:13.000-07:00
Until now, RBAC annotations under internal/controllers and
internal/controllers/hub were scattered across multiple controller
files.

With this commit, the annotations are now centralized only in the
Module controller and the MCM controller.

This change addresses the issue where annotations spread across
various controllers are applied only to KMM and not to KMM-hub—
because all controllers except MCM reside in internal/controllers,
and RBAC generation for KMM-hub only scans
internal/controllers/hub.
diff --git a/internal/controllers/build_sign_reconciler.go b/internal/controllers/build_sign_reconciler.go
@@ -64,13 +64,6 @@ func NewBuildSignReconciler(
 	}
 }
 
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch;update;patch
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules/status,verbs=get;update;patch
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=configmaps,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=pods,verbs=create;list;watch;delete
-
 // Reconcile lists all nodes and looks for kernels that match its mappings.
 // For each mapping that matches at least one node in the cluster, it creates a DaemonSet running the container image
 // on the nodes with a compatible kernel.
diff --git a/internal/controllers/device_plugin_pod_reconciler.go b/internal/controllers/device_plugin_pod_reconciler.go
@@ -18,9 +18,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 )
 
-//+kubebuilder:rbac:groups="core",resources=pods,verbs=get;patch;list;watch
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;watch
-
 const DevicePluginPodReconcilerName = "DevicePluginPod"
 
 type DevicePluginPodReconciler struct {
diff --git a/internal/controllers/device_plugin_reconciler.go b/internal/controllers/device_plugin_reconciler.go
@@ -79,12 +79,6 @@ func (r *DevicePluginReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		)
 }
 
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch;
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules/status,verbs=get;update;patch
-//+kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=create;delete;get;list;patch;watch
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch
-
 func (r *DevicePluginReconciler) Reconcile(ctx context.Context, mod *kmmv1beta1.Module) (ctrl.Result, error) {
 	res := ctrl.Result{}
 
diff --git a/internal/controllers/mbsc_reconciler.go b/internal/controllers/mbsc_reconciler.go
@@ -63,12 +63,6 @@ func (r *mbscReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		)
 }
 
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modulebuildsignconfigs,verbs=get;list;watch;update;patch;create
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modulebuildsignconfigs/status,verbs=get;update;patch
-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=configmaps,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=pods,verbs=create;list;watch;delete
-
 func (r *mbscReconciler) Reconcile(ctx context.Context, mbscObj *kmmv1beta1.ModuleBuildSignConfig) (ctrl.Result, error) {
 	res := ctrl.Result{}
 
diff --git a/internal/controllers/mic_reconciler.go b/internal/controllers/mic_reconciler.go
@@ -63,9 +63,6 @@ func (r *micReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		)
 }
 
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=moduleimagesconfigs,verbs=get;list;watch;patch;create;delete
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=moduleimagesconfigs/status,verbs=get;update;patch
-
 func (r *micReconciler) Reconcile(ctx context.Context, micObj *kmmv1beta1.ModuleImagesConfig) (ctrl.Result, error) {
 	res := ctrl.Result{}
 	if micObj.GetDeletionTimestamp() != nil {
diff --git a/internal/controllers/module_reconciler.go b/internal/controllers/module_reconciler.go
@@ -32,9 +32,23 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
 
-//+kubebuilder:rbac:groups="core",resources=namespaces,verbs=get;list;patch;watch
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;watch
+//+kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=create;delete;get;list;patch;watch
+//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,resourceNames=kernel-versions.kmm.node.kubernetes.io,verbs=delete;patch;update
+//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,verbs=create;get;list;watch
+//+kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch
+//+kubebuilder:rbac:groups=core,resources=namespaces,verbs=get;list;patch;watch
+//+kubebuilder:rbac:groups=core,resources=nodes,verbs=get;list;watch;patch
+//+kubebuilder:rbac:groups=core,resources=pods,verbs=create;delete;get;list;patch;watch
+//+kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch
+//+kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modulebuildsignconfigs,verbs=get;list;watch;update;patch;create
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modulebuildsignconfigs/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=moduleimagesconfigs,verbs=get;list;watch;patch;create;delete
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=moduleimagesconfigs/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch;update;patch
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=nodemodulesconfigs,verbs=get;list;watch;patch;create;delete
+//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=nodemodulesconfigs/status,verbs=patch
 
 const (
 	ModuleReconcilerName = "ModuleReconciler"
diff --git a/internal/controllers/nmc_reconciler.go b/internal/controllers/nmc_reconciler.go
@@ -37,13 +37,6 @@ const (
 	NodeModulesConfigReconcilerName = "NodeModulesConfig"
 )
 
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=nodemodulesconfigs,verbs=get;list;watch
-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=nodemodulesconfigs/status,verbs=patch
-//+kubebuilder:rbac:groups="core",resources=pods,verbs=create;delete;get;list;watch
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=serviceaccounts,verbs=get;list;watch
-
 type NMCReconciler struct {
 	client     client.Client
 	helper     nmcReconcilerHelper
diff --git a/internal/controllers/node_kernel_clusterclaim.go b/internal/controllers/node_kernel_clusterclaim.go
@@ -21,10 +21,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
 
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;patch;list;watch
-//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,verbs=create;get;list;watch
-//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,resourceNames=kernel-versions.kmm.node.kubernetes.io,verbs=delete;patch;update
-
 const (
 	NodeKernelClusterClaimReconcilerName = "NodeKernelClusterClaim"
 )
diff --git a/internal/controllers/node_label_module_version_reconciler.go b/internal/controllers/node_label_module_version_reconciler.go
@@ -16,8 +16,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
 
-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;watch;patch
-
 // this struct contains all the version labels related to a specific Module
 type modulesVersionLabels struct {
 	name                     string

Original file line number	Diff line number	Diff line change
`@@ -64,13 +64,6 @@ func NewBuildSignReconciler(`
`64`	`64`	`}`
`65`	`65`	`}`
`66`	`66`
`67`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch;update;patch`
`68`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules/status,verbs=get;update;patch`
`69`		`-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;list;watch`
`70`		`-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch`
`71`		`-//+kubebuilder:rbac:groups="core",resources=configmaps,verbs=get;list;watch`
`72`		`-//+kubebuilder:rbac:groups="core",resources=pods,verbs=create;list;watch;delete`
`73`		`-`
`74`	`67`	`// Reconcile lists all nodes and looks for kernels that match its mappings.`
`75`	`68`	`// For each mapping that matches at least one node in the cluster, it creates a DaemonSet running the container image`
`76`	`69`	`// on the nodes with a compatible kernel.`
Original file line number	Diff line number	Diff line change
`@@ -18,9 +18,6 @@ import (`
`18`	`18`	`"sigs.k8s.io/controller-runtime/pkg/predicate"`
`19`	`19`	`)`
`20`	`20`
`21`		`-//+kubebuilder:rbac:groups="core",resources=pods,verbs=get;patch;list;watch`
`22`		`-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;watch`
`23`		`-`
`24`	`21`	`const DevicePluginPodReconcilerName = "DevicePluginPod"`
`25`	`22`
`26`	`23`	`type DevicePluginPodReconciler struct {`
Original file line number	Diff line number	Diff line change
`@@ -79,12 +79,6 @@ func (r *DevicePluginReconciler) SetupWithManager(mgr ctrl.Manager) error {`
`79`	`79`	`)`
`80`	`80`	`}`
`81`	`81`
`82`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules,verbs=get;list;watch;`
`83`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modules/status,verbs=get;update;patch`
`84`		`-//+kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=create;delete;get;list;patch;watch`
`85`		`-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;list;watch`
`86`		`-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch`
`87`		`-`
`88`	`82`	`func (r DevicePluginReconciler) Reconcile(ctx context.Context, mod kmmv1beta1.Module) (ctrl.Result, error) {`
`89`	`83`	`res := ctrl.Result{}`
`90`	`84`
Original file line number	Diff line number	Diff line change
`@@ -63,12 +63,6 @@ func (r *mbscReconciler) SetupWithManager(mgr ctrl.Manager) error {`
`63`	`63`	`)`
`64`	`64`	`}`
`65`	`65`
`66`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modulebuildsignconfigs,verbs=get;list;watch;update;patch;create`
`67`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=modulebuildsignconfigs/status,verbs=get;update;patch`
`68`		`-//+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch`
`69`		`-//+kubebuilder:rbac:groups="core",resources=configmaps,verbs=get;list;watch`
`70`		`-//+kubebuilder:rbac:groups="core",resources=pods,verbs=create;list;watch;delete`
`71`		`-`
`72`	`66`	`func (r mbscReconciler) Reconcile(ctx context.Context, mbscObj kmmv1beta1.ModuleBuildSignConfig) (ctrl.Result, error) {`
`73`	`67`	`res := ctrl.Result{}`
`74`	`68`
Original file line number	Diff line number	Diff line change
`@@ -63,9 +63,6 @@ func (r *micReconciler) SetupWithManager(mgr ctrl.Manager) error {`
`63`	`63`	`)`
`64`	`64`	`}`
`65`	`65`
`66`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=moduleimagesconfigs,verbs=get;list;watch;patch;create;delete`
`67`		`-//+kubebuilder:rbac:groups=kmm.sigs.x-k8s.io,resources=moduleimagesconfigs/status,verbs=get;update;patch`
`68`		`-`
`69`	`66`	`func (r micReconciler) Reconcile(ctx context.Context, micObj kmmv1beta1.ModuleImagesConfig) (ctrl.Result, error) {`
`70`	`67`	`res := ctrl.Result{}`
`71`	`68`	`if micObj.GetDeletionTimestamp() != nil {`
Original file line number	Diff line number	Diff line change
`@@ -21,10 +21,6 @@ import (`
`21`	`21`	`"sigs.k8s.io/controller-runtime/pkg/reconcile"`
`22`	`22`	`)`
`23`	`23`
`24`		`-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;patch;list;watch`
`25`		`-//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,verbs=create;get;list;watch`
`26`		`-//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,resourceNames=kernel-versions.kmm.node.kubernetes.io,verbs=delete;patch;update`
`27`		`-`
`28`	`24`	`const (`
`29`	`25`	`NodeKernelClusterClaimReconcilerName = "NodeKernelClusterClaim"`
`30`	`26`	`)`
Original file line number	Diff line number	Diff line change
`@@ -16,8 +16,6 @@ import (`
`16`	`16`	`"sigs.k8s.io/controller-runtime/pkg/reconcile"`
`17`	`17`	`)`
`18`	`18`
`19`		`-//+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;watch;patch`
`20`		`-`
`21`	`19`	`// this struct contains all the version labels related to a specific Module`
`22`	`20`	`type modulesVersionLabels struct {`
`23`	`21`	`name string`