forklift: add missing expected events

Signed-off-by: Benny Zlotnik <[email protected]>
kubevirt · Jun 25, 2024 · e0b0dc2 · e0b0dc2
1 parent 05c53a2
commit e0b0dc2
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 26 deletions.
diff --git a/pkg/operator/controller/controller_test.go b/pkg/operator/controller/controller_test.go
@@ -1934,5 +1934,13 @@ func createNotReadyEventValidationMap() map[string]bool {
 	match[normalCreateSuccess+" *v1.Secret cdi-uploadserver-client-cert"] = false
 	match[normalCreateSuccess+" *v1.Service cdi-prometheus-metrics"] = false
 	match[normalCreateEnsured+" SecurityContextConstraint exists"] = false
+
+	// Forklift
+	match[normalCreateSuccess+" *v1.ClusterRole forklift.cdi.kubevirt.io:admin"] = false
+	match[normalCreateSuccess+" *v1.ClusterRole forklift.cdi.kubevirt.io:edit"] = false
+	match[normalCreateSuccess+" *v1.ClusterRole forklift.cdi.kubevirt.io:view"] = false
+	match[normalCreateSuccess+" *v1.ClusterRole forklift.cdi.kubevirt.io:config-reader"] = false
+	match[normalCreateSuccess+" *v1.ClusterRoleBinding forklift.cdi.kubevirt.io:config-reader"] = false
+
 	return match
 }
diff --git a/pkg/operator/resources/cluster/controller.go b/pkg/operator/resources/cluster/controller.go
@@ -165,9 +165,11 @@ func getControllerClusterPolicyRules() []rbacv1.PolicyRule {
 				"get",
 			},
 		},
+		// "*" permissions are usually bad, but it makes sense for CDI to have them as it controls everything related
 		{
 			APIGroups: []string{
 				"cdi.kubevirt.io",
+				"forklift.cdi.kubevirt.io",
 			},
 			Resources: []string{
 				"*",
@@ -266,18 +268,6 @@ func getControllerClusterPolicyRules() []rbacv1.PolicyRule {
 				"update",
 			},
 		},
-		{
-			APIGroups: []string{
-				"forklift.cdi.kubevirt.io",
-			},
-			Resources: []string{
-				"ovirtvolumepopulators",
-				"openstackvolumepopulators",
-			},
-			Verbs: []string{
-				"*",
-			},
-		},
 	}
 }
 

diff --git a/pkg/operator/resources/cluster/rbac.go b/pkg/operator/resources/cluster/rbac.go
@@ -168,20 +168,6 @@ func createConfigReaderClusterRole(name string) *rbacv1.ClusterRole {
 				"watch",
 			},
 		},
-		{
-			APIGroups: []string{
-				"forklift.cdi.kubevirt.io",
-			},
-			Resources: []string{
-				"ovirtvolumepopulators",
-				"openstackvolumepopulators",
-			},
-			Verbs: []string{
-				"get",
-				"list",
-				"watch",
-			},
-		},
 	}
 
 	return utils.ResourceBuilder.CreateClusterRole(name, rules)