Merge pull request #2013 from marquiz/release-0.16

[release-0.16] Add support running with OwnerReferencesPermissionEnforcement

Author: k8s-ci-robot

deployment/base/rbac/worker-role.yaml

@@ -11,6 +11,7 @@ rules:
   - create
   - get
   - update
+  - delete
 - apiGroups:
   - ""
   resources:

deployment/helm/node-feature-discovery/templates/role.yaml

@@ -15,6 +15,7 @@ rules:
   - create
   - get
   - update
+  - delete
 - apiGroups:
   - ""
   resources:

pkg/nfd-worker/nfd-worker.go

@@ -41,6 +41,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/validation"
 	k8sclient "k8s.io/client-go/kubernetes"
 	"k8s.io/klog/v2"
+	"k8s.io/utils/ptr"
 	klogutils "sigs.k8s.io/node-feature-discovery/pkg/utils/klog"
 	"sigs.k8s.io/yaml"
 
@@ -325,7 +326,10 @@ func (w *nfdWorker) Run() error {
 			klog.ErrorS(err, "failed to get self pod, cannot inherit ownerReference for NodeFeature")
 			return err
 		} else {
-			ownerReference = append(ownerReference, selfPod.OwnerReferences...)
+			for _, owner := range selfPod.OwnerReferences {
+				owner.BlockOwnerDeletion = ptr.To(false)
+				ownerReference = append(ownerReference, owner)
+			}
 		}
 
 		podUID := os.Getenv("POD_UID")

test/e2e/utils/rbac.go

@@ -222,7 +222,7 @@ func createRoleWorker(ctx context.Context, cs clientset.Interface, ns string) (*
 			{
 				APIGroups: []string{"nfd.k8s-sigs.io"},
 				Resources: []string{"nodefeatures"},
-				Verbs:     []string{"create", "get", "update"},
+				Verbs:     []string{"create", "get", "update", "delete"},
 			},
 			{
 				APIGroups: []string{""},