operator: allow controllers to touch ownerRefernces always

Clusters with OwnerReferencesPermissionEnforcement (e.g., OpenShift) get stricter checks for metadata.ownerReferences. This appears via errors like: “is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can’t set finalizers on: ...” The fix is to add "update" permissions to finalizers subresource for the xDevicePlugins resources. Signed-off-by: Mikko Ylinen <[email protected]>
intel · Nov 18, 2021 · 6bbc337 · 6bbc337
1 parent 471549c
commit 6bbc337
Show file tree

Hide file tree

Showing 8 changed files with 43 additions and 1 deletion.
diff --git a/deployments/operator/rbac/role.yaml b/deployments/operator/rbac/role.yaml
@@ -63,6 +63,12 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - dlbdeviceplugins/finalizers
+  verbs:
+  - update
 - apiGroups:
   - deviceplugin.intel.com
   resources:
@@ -83,6 +89,12 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - dsadeviceplugins/finalizers
+  verbs:
+  - update
 - apiGroups:
   - deviceplugin.intel.com
   resources:
@@ -103,6 +115,12 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - fpgadeviceplugins/finalizers
+  verbs:
+  - update
 - apiGroups:
   - deviceplugin.intel.com
   resources:
@@ -123,6 +141,12 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - gpudeviceplugins/finalizers
+  verbs:
+  - update
 - apiGroups:
   - deviceplugin.intel.com
   resources:
@@ -143,6 +167,12 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - qatdeviceplugins/finalizers
+  verbs:
+  - update
 - apiGroups:
   - deviceplugin.intel.com
   resources:
@@ -163,6 +193,12 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - deviceplugin.intel.com
+  resources:
+  - sgxdeviceplugins/finalizers
+  verbs:
+  - update
 - apiGroups:
   - deviceplugin.intel.com
   resources:

diff --git a/deployments/operator/webhook/manifests.yaml b/deployments/operator/webhook/manifests.yaml
@@ -12,7 +12,7 @@ webhooks:
     service:
       name: webhook-service
       namespace: system
- path: /mutate-deviceplugin-intel-com-v1-dlbdeviceplugin
+      path: /mutate-deviceplugin-intel-com-v1-dlbdeviceplugin
   failurePolicy: Fail
   name: mdlbdeviceplugin.kb.io
   rules:

diff --git a/pkg/controllers/dlb/controller.go b/pkg/controllers/dlb/controller.go
@@ -41,6 +41,7 @@ const (
 
 // +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=dlbdeviceplugins,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=dlbdeviceplugins/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=dlbdeviceplugins/finalizers,verbs=update
 
 // SetupReconciler creates a new reconciler for DlbDevicePlugin objects.
 func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error {

diff --git a/pkg/controllers/dsa/controller.go b/pkg/controllers/dsa/controller.go
@@ -41,6 +41,7 @@ const (
 
 // +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=dsadeviceplugins,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=dsadeviceplugins/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=dsadeviceplugins/finalizers,verbs=update
 
 // SetupReconciler creates a new reconciler for DsaDevicePlugin objects.
 func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error {

diff --git a/pkg/controllers/fpga/controller.go b/pkg/controllers/fpga/controller.go
@@ -41,6 +41,7 @@ const (
 
 // +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=fpgadeviceplugins,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=fpgadeviceplugins/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=fpgadeviceplugins/finalizers,verbs=update
 
 // SetupReconciler creates a new reconciler for FpgaDevicePlugin objects.
 func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error {

diff --git a/pkg/controllers/gpu/controller.go b/pkg/controllers/gpu/controller.go
@@ -43,6 +43,7 @@ const (
 
 // +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=gpudeviceplugins,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=gpudeviceplugins/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=gpudeviceplugins/finalizers,verbs=update
 
 // SetupReconciler creates a new reconciler for GpuDevicePlugin objects.
 func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error {

diff --git a/pkg/controllers/qat/controller.go b/pkg/controllers/qat/controller.go
@@ -41,6 +41,7 @@ const (
 
 // +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=qatdeviceplugins,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=qatdeviceplugins/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=qatdeviceplugins/finalizers,verbs=update
 
 // SetupReconciler creates a new reconciler for QatDevicePlugin objects.
 func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error {

diff --git a/pkg/controllers/sgx/controller.go b/pkg/controllers/sgx/controller.go
@@ -41,6 +41,7 @@ const (
 
 // +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=sgxdeviceplugins,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=sgxdeviceplugins/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=sgxdeviceplugins/finalizers,verbs=update
 
 // SetupReconciler creates a new reconciler for SgxDevicePlugin objects.
 func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error {