From 7d2ae969687a8296423e5aa6929de731e20331d2 Mon Sep 17 00:00:00 2001 From: dttung2905 Date: Tue, 11 Aug 2026 23:32:19 +0100 Subject: [PATCH 1/2] Fix: tighten configmap verb for admission, nodescaleadjuster, podgroupcontroller, podgrouper, queuecontroller, scheduler ClusterRole Signed-off-by: dttung2905 --- cmd/admission/app/app.go | 1 - cmd/nodescaleadjuster/app/app.go | 1 - cmd/podgroupcontroller/app/app.go | 1 - cmd/podgrouper/app/app.go | 1 - cmd/queuecontroller/app/app.go | 1 - cmd/scheduler/app/server.go | 1 - .../templates/rbac/admission.yaml | 12 ----------- .../templates/rbac/nodescaleadjuster.yaml | 15 +++++++------- .../templates/rbac/podgroupcontroller.yaml | 12 ----------- .../templates/rbac/podgrouper.yaml | 13 +----------- .../templates/rbac/queuecontroller.yaml | 12 ----------- .../templates/rbac/scheduler.yaml | 20 +++++++++---------- 12 files changed, 18 insertions(+), 72 deletions(-) diff --git a/cmd/admission/app/app.go b/cmd/admission/app/app.go index 426b87c2b..65edff3d9 100644 --- a/cmd/admission/app/app.go +++ b/cmd/admission/app/app.go @@ -140,7 +140,6 @@ func (app *App) RegisterPlugins(admissionPlugins *admissionplugins.KaiAdmissionP app.admissionPlugins = admissionPlugins } -// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=core,resources=events,verbs=create;patch;update diff --git a/cmd/nodescaleadjuster/app/app.go b/cmd/nodescaleadjuster/app/app.go index d3e58a222..685da6848 100644 --- a/cmd/nodescaleadjuster/app/app.go +++ b/cmd/nodescaleadjuster/app/app.go @@ -33,7 +33,6 @@ func init() { // +kubebuilder:scaffold:scheme } -// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=core,resources=events,verbs=create;patch;update diff --git a/cmd/podgroupcontroller/app/app.go b/cmd/podgroupcontroller/app/app.go index 0b448d751..2a6cc75bf 100644 --- a/cmd/podgroupcontroller/app/app.go +++ b/cmd/podgroupcontroller/app/app.go @@ -48,7 +48,6 @@ func init() { // +kubebuilder:scaffold:scheme } -// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete func Run(options *Options, config *rest.Config, ctx context.Context) error { diff --git a/cmd/podgrouper/app/app.go b/cmd/podgrouper/app/app.go index 33968ec04..1546ada54 100644 --- a/cmd/podgrouper/app/app.go +++ b/cmd/podgrouper/app/app.go @@ -134,7 +134,6 @@ func (app *App) RegisterPlugins(pluginsHub pluginshub.PluginsHub) { app.pluginsHub = pluginsHub } -// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete func (app *App) Run() error { diff --git a/cmd/queuecontroller/app/app.go b/cmd/queuecontroller/app/app.go index 3150e6287..ee5b042f4 100644 --- a/cmd/queuecontroller/app/app.go +++ b/cmd/queuecontroller/app/app.go @@ -43,7 +43,6 @@ func init() { // +kubebuilder:scaffold:scheme } -// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete func Run(opts *Options, clientConfig *rest.Config, ctx context.Context) error { diff --git a/cmd/scheduler/app/server.go b/cmd/scheduler/app/server.go index 3e09cb08d..9f40ede06 100644 --- a/cmd/scheduler/app/server.go +++ b/cmd/scheduler/app/server.go @@ -180,7 +180,6 @@ func setConfig(so *options.ServerOption) { config.MIGWorkerNodeLabelKey = so.MIGWorkerNodeLabelKey } -// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete func Run(ctx context.Context, opt *options.ServerOption, config *restclient.Config, mux *http.ServeMux) error { diff --git a/deployments/kai-scheduler/templates/rbac/admission.yaml b/deployments/kai-scheduler/templates/rbac/admission.yaml index 72122bba3..fa0a425f8 100644 --- a/deployments/kai-scheduler/templates/rbac/admission.yaml +++ b/deployments/kai-scheduler/templates/rbac/admission.yaml @@ -10,18 +10,6 @@ kind: ClusterRole metadata: name: kai-admission rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - delete - - get - - list - - patch - - update - - watch - apiGroups: - "" resources: diff --git a/deployments/kai-scheduler/templates/rbac/nodescaleadjuster.yaml b/deployments/kai-scheduler/templates/rbac/nodescaleadjuster.yaml index 515676fe9..0ae3f3a56 100644 --- a/deployments/kai-scheduler/templates/rbac/nodescaleadjuster.yaml +++ b/deployments/kai-scheduler/templates/rbac/nodescaleadjuster.yaml @@ -13,25 +13,24 @@ rules: - apiGroups: - "" resources: - - configmaps - - pods + - events + - pods/finalizers verbs: - create - - delete - - get - - list - patch - update - - watch - apiGroups: - "" resources: - - events - - pods/finalizers + - pods verbs: - create + - delete + - get + - list - patch - update + - watch - apiGroups: - "" resources: diff --git a/deployments/kai-scheduler/templates/rbac/podgroupcontroller.yaml b/deployments/kai-scheduler/templates/rbac/podgroupcontroller.yaml index 4af54ebe2..f753a43f7 100644 --- a/deployments/kai-scheduler/templates/rbac/podgroupcontroller.yaml +++ b/deployments/kai-scheduler/templates/rbac/podgroupcontroller.yaml @@ -10,18 +10,6 @@ kind: ClusterRole metadata: name: kai-podgroup-controller rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - delete - - get - - list - - patch - - update - - watch - apiGroups: - "" resources: diff --git a/deployments/kai-scheduler/templates/rbac/podgrouper.yaml b/deployments/kai-scheduler/templates/rbac/podgrouper.yaml index 39480494a..de56064a4 100644 --- a/deployments/kai-scheduler/templates/rbac/podgrouper.yaml +++ b/deployments/kai-scheduler/templates/rbac/podgrouper.yaml @@ -14,13 +14,10 @@ rules: - "" resources: - configmaps + - namespaces verbs: - - create - - delete - get - list - - patch - - update - watch - apiGroups: - "" @@ -34,14 +31,6 @@ rules: - patch - update - watch -- apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - list - - watch - apiGroups: - "" resources: diff --git a/deployments/kai-scheduler/templates/rbac/queuecontroller.yaml b/deployments/kai-scheduler/templates/rbac/queuecontroller.yaml index a911cd9a0..8df75394a 100644 --- a/deployments/kai-scheduler/templates/rbac/queuecontroller.yaml +++ b/deployments/kai-scheduler/templates/rbac/queuecontroller.yaml @@ -10,18 +10,6 @@ kind: ClusterRole metadata: name: queuecontroller rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - delete - - get - - list - - patch - - update - - watch - apiGroups: - coordination.k8s.io resources: diff --git a/deployments/kai-scheduler/templates/rbac/scheduler.yaml b/deployments/kai-scheduler/templates/rbac/scheduler.yaml index de191d8d1..6b294ed00 100644 --- a/deployments/kai-scheduler/templates/rbac/scheduler.yaml +++ b/deployments/kai-scheduler/templates/rbac/scheduler.yaml @@ -14,26 +14,26 @@ rules: - "" resources: - configmaps - - events - - pods/status + - namespaces + - nodes + - persistentvolumeclaims + - persistentvolumes verbs: - - create - - delete - get - list - - patch - - update - watch - apiGroups: - "" resources: - - namespaces - - nodes - - persistentvolumeclaims - - persistentvolumes + - events + - pods/status verbs: + - create + - delete - get - list + - patch + - update - watch - apiGroups: - "" From cbe336b8a400cd66f0f6a9e25cad9f5ea9d98477 Mon Sep 17 00:00:00 2001 From: dttung2905 Date: Tue, 11 Aug 2026 23:33:26 +0100 Subject: [PATCH 2/2] Add changelog Signed-off-by: dttung2905 --- .changes/unreleased/Fixed-20260811-233307.yaml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .changes/unreleased/Fixed-20260811-233307.yaml diff --git a/.changes/unreleased/Fixed-20260811-233307.yaml b/.changes/unreleased/Fixed-20260811-233307.yaml new file mode 100644 index 000000000..4a9dc5e5b --- /dev/null +++ b/.changes/unreleased/Fixed-20260811-233307.yaml @@ -0,0 +1,6 @@ +kind: Fixed +body: tighten configmap verb for admission, nodescaleadjuster, podgroupcontroller, podgrouper, queuecontroller, scheduler ClusterRole +time: 2026-08-11T23:33:07.93807465+01:00 +custom: + Author: dttung2905 + Issue: "2060"