Fix(clusterRole): - Remove ConfigMap access entirely from kai-admission, queuecontroller, kai-podgroup-controller, and kai-node-scale-adjuster

.changes/unreleased/Fixed-20260811-233307.yaml

@@ -0,0 +1,6 @@
+kind: Fixed
+body: tighten configmap verb for admission, nodescaleadjuster, podgroupcontroller, podgrouper, queuecontroller, scheduler ClusterRole
+time: 2026-08-11T23:33:07.93807465+01:00
+custom:
+    Author: dttung2905
+    Issue: "2060"

cmd/admission/app/app.go

@@ -140,7 +140,6 @@ func (app *App) RegisterPlugins(admissionPlugins *admissionplugins.KaiAdmissionP
 	app.admissionPlugins = admissionPlugins
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=core,resources=events,verbs=create;patch;update
 

cmd/nodescaleadjuster/app/app.go

@@ -33,7 +33,6 @@ func init() {
 	// +kubebuilder:scaffold:scheme
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=core,resources=events,verbs=create;patch;update
 

cmd/podgroupcontroller/app/app.go

@@ -48,7 +48,6 @@ func init() {
 	// +kubebuilder:scaffold:scheme
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
 
 func Run(options *Options, config *rest.Config, ctx context.Context) error {

cmd/podgrouper/app/app.go

@@ -134,7 +134,6 @@ func (app *App) RegisterPlugins(pluginsHub pluginshub.PluginsHub) {
 	app.pluginsHub = pluginsHub
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
 
 func (app *App) Run() error {

cmd/queuecontroller/app/app.go

@@ -43,7 +43,6 @@ func init() {
 	// +kubebuilder:scaffold:scheme
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
 
 func Run(opts *Options, clientConfig *rest.Config, ctx context.Context) error {

cmd/scheduler/app/server.go

@@ -180,7 +180,6 @@ func setConfig(so *options.ServerOption) {
 	config.MIGWorkerNodeLabelKey = so.MIGWorkerNodeLabelKey
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=coordination.k8s.io,resources=leases,verbs=get;list;watch;create;update;patch;delete
 
 func Run(ctx context.Context, opt *options.ServerOption, config *restclient.Config, mux *http.ServeMux) error {

deployments/kai-scheduler/templates/rbac/admission.yaml

@@ -10,18 +10,6 @@ kind: ClusterRole
 metadata:
   name: kai-admission
 rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - ""
   resources:

deployments/kai-scheduler/templates/rbac/nodescaleadjuster.yaml

@@ -13,25 +13,24 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - configmaps
-  - pods
+  - events
+  - pods/finalizers
   verbs:
   - create
-  - delete
-  - get
-  - list
   - patch
   - update
-  - watch
 - apiGroups:
   - ""
   resources:
-  - events
-  - pods/finalizers
+  - pods
   verbs:
   - create
+  - delete
+  - get
+  - list
   - patch
   - update
+  - watch
 - apiGroups:
   - ""
   resources:

deployments/kai-scheduler/templates/rbac/podgroupcontroller.yaml

@@ -10,18 +10,6 @@ kind: ClusterRole
 metadata:
   name: kai-podgroup-controller
 rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - ""
   resources:

deployments/kai-scheduler/templates/rbac/podgrouper.yaml

@@ -14,13 +14,10 @@ rules:
   - ""
   resources:
   - configmaps
+  - namespaces
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - ""
@@ -34,14 +31,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - namespaces
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - ""
   resources:

deployments/kai-scheduler/templates/rbac/queuecontroller.yaml

@@ -10,18 +10,6 @@ kind: ClusterRole
 metadata:
   name: queuecontroller
 rules:
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - coordination.k8s.io
   resources:

deployments/kai-scheduler/templates/rbac/scheduler.yaml

@@ -14,26 +14,26 @@ rules:
   - ""
   resources:
   - configmaps
-  - events
-  - pods/status
+  - namespaces
+  - nodes
+  - persistentvolumeclaims
+  - persistentvolumes
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - ""
   resources:
-  - namespaces
-  - nodes
-  - persistentvolumeclaims
-  - persistentvolumes
+  - events
+  - pods/status
   verbs:
+  - create
+  - delete
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - ""