EPMDEDP-17305: fix: Reduce the operator's RBAC to the permissions it uses

Every grant is backed by a call site.

1. The chart ships no cluster-scoped RBAC. The ServiceAccount holds one
   namespaced Role and one RoleBinding.

2. Verbs are explicit per resource: secrets get;list;watch;update;delete;
   configmaps, quicklinks and triggertemplates get; ingresses, httproutes and
   routes get;create; cdpipelines and stages get;list; pipelineruns
   list;watch;create; eventlisteners get;create;patch; leases
   create;get;update; /status get;patch;update; /finalizers update.

3. The cache holds only Secrets labelled app.edp.epam.com/integration-secret,
   the one type a controller watches. Everything else is read live through
   client.Cache.DisableFor, so no informer starts and no list/watch is needed.
   DefaultTransform strips managedFields.

4. The kubebuilder markers are the single source of truth. controller-gen
   emits a namespaced Role only; both chart Roles mirror config/rbac/role.yaml
   and differ solely by the platform split.

5. The kustomize path mirrors the chart: manager-role bound by a RoleBinding,
   carrying leader-election leases and events, plus metrics-auth for the
   metrics endpoint that config/default enables.

Signed-off-by: Sergiy Kulanov <sergiy_kulanov@epam.com>

Author: SergK

cmd/main.go

@@ -16,13 +16,15 @@ import (
 	routeApi "github.com/openshift/api/route/v1"
 	tektonpipelineApi "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1"
 	tektonTriggersApi "github.com/tektoncd/triggers/pkg/apis/triggers/v1beta1"
+	corev1 "k8s.io/api/core/v1"
 	networkingV1 "k8s.io/api/networking/v1"
 	k8sruntime "k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/certwatcher"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
@@ -67,6 +69,27 @@ const (
 	branchStaleCheckDefaultInterval          = time.Hour * 24
 )
 
+// uncachedTypes are read live. No informer is started for them, so the Role needs only
+// the verbs each call site uses. Secret is listed here as well: its informer, scoped
+// below, exists for watching alone.
+//
+// client.MatchingFields is served by the cache only. Never field-index a type listed
+// here (pkg/codebase/index.go), and never list an indexed type here.
+var uncachedTypes = []client.Object{
+	&corev1.Secret{},
+	&corev1.ConfigMap{},
+	&codebaseApiV1.QuickLink{},
+	&cdPipeApi.CDPipeline{},
+	&cdPipeApi.Stage{},
+	&tektonTriggersApi.TriggerTemplate{},
+	&networkingV1.Ingress{},
+	&gatewayv1.HTTPRoute{},
+	&routeApi.Route{},
+}
+
+// Leader election lock. resourcelock.LeasesLock calls Get/Create/Update.
+// +kubebuilder:rbac:groups=coordination.k8s.io,namespace=placeholder,resources=leases,verbs=get;create;update
+
 func main() {
 	var (
 		metricsAddr                                      string
@@ -224,6 +247,13 @@ func main() {
 		os.Exit(1)
 	}
 
+	secretCacheSelector := integrationsecret.CacheSelector()
+
+	setupLog.Info("Restricting the cache",
+		"namespace", ns,
+		"secretLabelSelector", secretCacheSelector.String(),
+	)
+
 	cfg := ctrl.GetConfigOrDie()
 
 	mgr, err := ctrl.NewManager(cfg, ctrl.Options{
@@ -235,6 +265,15 @@ func main() {
 		LeaderElectionID:       codebaseOperatorLock,
 		Cache: cache.Options{
 			DefaultNamespaces: map[string]cache.Config{ns: {}},
+			DefaultTransform:  cache.TransformStripManagedFields(),
+			ByObject: map[client.Object]cache.ByObject{
+				// Only the IntegrationSecret controller watches Secrets. The informer holds
+				// no other Secret in the namespace.
+				&corev1.Secret{}: {Label: secretCacheSelector},
+			},
+		},
+		Client: client.Options{
+			Cache: &client.CacheOptions{DisableFor: uncachedTypes},
 		},
 	})
 	if err != nil {

config/rbac/kustomization.yaml

@@ -5,10 +5,10 @@ resources:
 # runtime. Be sure to update RoleBinding and ClusterRoleBinding
 # subjects if changing service account names.
 - service_account.yaml
+# manager-role covers every operator permission, leader-election leases and events
+# included. Generated from the kubebuilder markers by `make manifests`.
 - role.yaml
 - role_binding.yaml
-- leader_election_role.yaml
-- leader_election_role_binding.yaml
 # The following RBAC configurations are used to protect
 # the metrics endpoint with authn/authz. These configurations
 # ensure that only authorized users and service accounts

config/rbac/leader_election_role.yaml

@@ -1,101 +1,92 @@
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
   name: manager-role
+  namespace: placeholder
 rules:
 - apiGroups:
-  - v2.edp.epam.com
+  - ""
   resources:
-  - jiraissuemetadatas
-  - jiraservers
+  - configmaps
   verbs:
-  - create
-  - delete
   - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - v2.edp.epam.com
-  resources:
-  - jiraissuemetadatas/finalizers
-  - jiraservers/finalizers
-  verbs:
-  - update
 - apiGroups:
-  - v2.edp.epam.com
+  - ""
   resources:
-  - jiraissuemetadatas/status
-  - jiraservers/status
+  - events
   verbs:
-  - get
+  - create
   - patch
-  - update
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: manager-role
-  namespace: placeholder
-rules:
 - apiGroups:
   - ""
   resources:
   - secrets
   verbs:
+  - delete
   - get
   - list
-  - patch
   - update
   - watch
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+  - get
+  - update
 - apiGroups:
   - gateway.networking.k8s.io
   resources:
   - httproutes
   verbs:
   - create
   - get
-  - list
-  - watch
 - apiGroups:
   - networking.k8s.io
   resources:
   - ingresses
   verbs:
   - create
   - get
-  - list
-  - watch
 - apiGroups:
   - route.openshift.io
   resources:
   - routes
   verbs:
   - create
   - get
-  - list
-  - watch
 - apiGroups:
   - tekton.dev
   resources:
   - pipelineruns
   verbs:
   - create
-  - get
   - list
-  - patch
-  - update
   - watch
+- apiGroups:
+  - triggers.tekton.dev
+  resources:
+  - eventlisteners
+  verbs:
+  - create
+  - get
+  - patch
 - apiGroups:
   - triggers.tekton.dev
   resources:
   - triggertemplates
   verbs:
   - get
+- apiGroups:
+  - v2.edp.epam.com
+  resources:
+  - cdpipelines
+  - stages
+  verbs:
+  - get
   - list
-  - watch
 - apiGroups:
   - v2.edp.epam.com
   resources:
@@ -104,6 +95,8 @@ rules:
   - codebaseimagestreams
   - codebases
   - gitservers
+  - jiraissuemetadatas
+  - jiraservers
   verbs:
   - create
   - delete
@@ -120,6 +113,8 @@ rules:
   - codebaseimagestreams/finalizers
   - codebases/finalizers
   - gitservers/finalizers
+  - jiraissuemetadatas/finalizers
+  - jiraservers/finalizers
   verbs:
   - update
 - apiGroups:
@@ -130,7 +125,15 @@ rules:
   - codebaseimagestreams/status
   - codebases/status
   - gitservers/status
+  - jiraissuemetadatas/status
+  - jiraservers/status
   verbs:
   - get
   - patch
   - update
+- apiGroups:
+  - v2.edp.epam.com
+  resources:
+  - quicklinks
+  verbs:
+  - get

config/rbac/leader_election_role_binding.yaml

@@ -1,8 +1,10 @@
+# Every kubebuilder marker carries namespace=placeholder, so controller-gen emits a
+# namespaced Role. Bind it with a RoleBinding.
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   labels:
-    app.kubernetes.io/name: clusterrolebinding
+    app.kubernetes.io/name: rolebinding
     app.kubernetes.io/instance: manager-rolebinding
     app.kubernetes.io/component: rbac
     app.kubernetes.io/created-by: edp-codebase-operator
@@ -11,7 +13,7 @@ metadata:
   name: manager-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
+  kind: Role
   name: manager-role
 subjects:
 - kind: ServiceAccount

config/rbac/role.yaml

@@ -80,8 +80,10 @@ func (r *ReconcileCDStageDeploy) SetupWithManager(mgr ctrl.Manager) error {
 // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=cdstagedeployments,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=cdstagedeployments/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=cdstagedeployments/finalizers,verbs=update
-// +kubebuilder:rbac:groups=triggers.tekton.dev,namespace=placeholder,resources=triggertemplates,verbs=get;list;watch;
-// +kubebuilder:rbac:groups=tekton.dev,namespace=placeholder,resources=pipelineruns,verbs=get;list;watch;create;update;patch
+// +kubebuilder:rbac:groups=triggers.tekton.dev,namespace=placeholder,resources=triggertemplates,verbs=get
+// Cached List, hence list+watch.
+// +kubebuilder:rbac:groups=tekton.dev,namespace=placeholder,resources=pipelineruns,verbs=list;watch;create
+// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=cdpipelines;stages,verbs=get;list
 
 // Reconcile reads that state of the cluster for a CDStageDeploy object and makes changes based on the state.
 func (r *ReconcileCDStageDeploy) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) {

config/rbac/role_binding.yaml

@@ -91,7 +91,13 @@ func (r *ReconcileCodebase) SetupWithManager(mgr ctrl.Manager) error {
 // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebases,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebases/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebases/finalizers,verbs=update
-// +kubebuilder:rbac:groups=route.openshift.io,namespace=placeholder,resources=routes,verbs=get;list;watch
+// +kubebuilder:rbac:groups=route.openshift.io,namespace=placeholder,resources=routes,verbs=get
+// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=quicklinks,verbs=get
+// +kubebuilder:rbac:groups="",namespace=placeholder,resources=configmaps,verbs=get
+// update: webhook secret written into the GitServer Secret.
+// delete: clone credentials, when Codebase.spec.cloneRepositoryCredentials
+// .clearSecretAfterUse is set.
+// +kubebuilder:rbac:groups="",namespace=placeholder,resources=secrets,verbs=get;update;delete
 
 // Reconcile reads that state of the cluster for a Codebase object and makes changes based on the state.
 func (r *ReconcileCodebase) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) {

controllers/cdstagedeploy/cdstagedeploy_controller.go

@@ -99,6 +99,9 @@ func (r *ReconcileCodebaseBranch) SetupWithManager(mgr ctrl.Manager, maxConcurre
 // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebasebranches,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebasebranches/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebasebranches/finalizers,verbs=update
+// +kubebuilder:rbac:groups="",namespace=placeholder,resources=secrets,verbs=get
+// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=cdpipelines;stages,verbs=get;list
+// +kubebuilder:rbac:groups="",namespace=placeholder,resources=events,verbs=create;patch
 
 // Reconcile reads that state of the cluster for a CodebaseBranch object and makes changes based on the state.
 func (r *ReconcileCodebaseBranch) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) {

controllers/codebase/codebase_controller.go

@@ -74,6 +74,7 @@ func (r *ReconcileCodebaseImageStream) SetupWithManager(mgr ctrl.Manager) error
 // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebaseimagestreams,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebaseimagestreams/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebaseimagestreams/finalizers,verbs=update
+// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=cdpipelines;stages,verbs=get;list
 
 // Reconcile reads that state of the cluster for a CodebaseImageStream object and makes changes based on the state.
 func (r *ReconcileCodebaseImageStream) Reconcile(