Fix(clusterRole): - Remove ConfigMap access entirely from kai-admission, queuecontroller, kai-podgroup-controller, and kai-node-scale-adjuster (#2061)

Signed-off-by: dttung2905 <ttdao.2015@accountancy.smu.edu.sg>

Author: dttung2905

.changes/unreleased/Fixed-20260811-233307.yaml

@@ -0,0 +1,6 @@
+kind: Fixed
+body: tighten configmap verb for admission, nodescaleadjuster, podgroupcontroller, podgrouper, queuecontroller, scheduler ClusterRole
+time: 2026-08-11T23:33:07.93807465+01:00
+custom:
+    Author: dttung2905
+    Issue: "2060"

cmd/admission/app/app.go

@@ -132,7 +132,6 @@ func (app *App) RegisterPlugins(admissionPlugins *admissionplugins.KaiAdmissionP
 	app.admissionPlugins = admissionPlugins
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=core,resources=events,verbs=create;patch;update
 

cmd/nodescaleadjuster/app/app.go

@@ -33,7 +33,6 @@ func init() {
 	// +kubebuilder:scaffold:scheme
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=core,resources=events,verbs=create;patch;update
 

cmd/podgroupcontroller/app/app.go

@@ -48,7 +48,6 @@ func init() {
 	// +kubebuilder:scaffold:scheme
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
 
 func Run(options *Options, config *rest.Config, ctx context.Context) error {

cmd/podgrouper/app/app.go

@@ -134,7 +134,6 @@ func (app *App) RegisterPlugins(pluginsHub pluginshub.PluginsHub) {
 	app.pluginsHub = pluginsHub
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
 
 func (app *App) Run() error {

cmd/queuecontroller/app/app.go

@@ -43,7 +43,6 @@ func init() {
 	// +kubebuilder:scaffold:scheme
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
 
 func Run(opts *Options, clientConfig *rest.Config, ctx context.Context) error {

cmd/scheduler/app/server.go

@@ -180,7 +180,6 @@ func setConfig(so *options.ServerOption) {
 	config.MIGWorkerNodeLabelKey = so.MIGWorkerNodeLabelKey
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
 
 func Run(ctx context.Context, opt *options.ServerOption, config *restclient.Config, mux *http.ServeMux) error {

deployments/kai-scheduler/templates/rbac/admission.yaml

@@ -10,18 +10,6 @@ kind: ClusterRole
 metadata:
   name: kai-admission
 rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - ""
   resources:

deployments/kai-scheduler/templates/rbac/nodescaleadjuster.yaml

@@ -13,25 +13,24 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - configmaps
-  - pods
+  - events
+  - pods/finalizers
   verbs:
   - create
-  - delete
-  - get
-  - list
   - patch
   - update
-  - watch
 - apiGroups:
   - ""
   resources:
-  - events
-  - pods/finalizers
+  - pods
   verbs:
   - create
+  - delete
+  - get
+  - list
   - patch
   - update
+  - watch
 - apiGroups:
   - ""
   resources:

deployments/kai-scheduler/templates/rbac/podgroupcontroller.yaml

@@ -10,18 +10,6 @@ kind: ClusterRole
 metadata:
   name: kai-podgroup-controller
 rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - ""
   resources: