[ROSAENG-61300] Tighten certman-operator RBAC to least privilege

[charlesgong]

This PR removes cluster-wide wildcard RBAC permissions on core Kubernetes resources from the certman-operator ClusterRole.

What type of PR is this?
bug

What this PR does / why we need it?
Both deploy/role.yaml and deploy_pko/ClusterRole-certman-operator.yaml granted cluster-wide wildcard/full-CRUD access to secrets, configmaps, pods, services, endpoints, PVCs, events, and apps/* resources. A code audit confirmed the controller only needs:

• secrets: get/create/update (credential reads + TLS cert writes)
• configmaps: get (one operator configmap + aws-account-operator configmap)
• All other resources (pods, services, endpoints, PVCs, events, apps/*): unused, dropped entirely

A compromised operator pod or projected SA token previously had cluster-wide secret read/write/delete, exposing every Hive-managed cluster kubeconfig and cloud credential on the hub.

Which Jira/Github issue(s) this PR fixes?
Fixes https://issues.redhat.com/browse/ROSAENG-61300

Special notes for your reviewer:
The verb reduction on secrets (delete, list, patch, watch removed) is safe — the controller never calls List or Delete on secrets, only targeted Gets and Create/Update for TLS cert secrets. Grepped across all of pkg/ and controllers/ to confirm.

Pre-checks (if applicable):

• Tested latest changes against a cluster
• Included documentation changes with PR
• If this is a new object that is not intended for the FedRAMP environment (if unsure, please reach out to team FedRAMP), please exclude it with the appropriate label/annotation

Summary by CodeRabbit

• Security
  • Reduced the operator’s permissions to only the resources and actions required for certificate management.
  • Removed broad access to workloads, pods, services, endpoints, persistent volume claims, and events.
  • Limited access to secrets, ConfigMaps, and namespaces to specific read or management actions.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• build/Dockerfile is excluded by !build/**
• build/Dockerfile.olm-registry is excluded by !build/**

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 20b22c26-86b8-41c6-8240-f37995abb210

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 580ad74b-1085-4fdd-a3ee-8e17a48c3058

📥 Commits

Reviewing files that changed from the base of the PR and between ca5b1b7 and 52d8896.

📒 Files selected for processing (2)

• deploy/role.yaml
• deploy_pko/ClusterRole-certman-operator.yaml

---

Walkthrough

The two certman-operator ClusterRole manifests replace broad wildcard permissions with scoped access to Secrets, ConfigMaps, and Namespaces.

Changes

RBAC permission scope

Layer / File(s)	Summary
Narrow ClusterRole permissions deploy/role.yaml, deploy_pko/ClusterRole-certman-operator.yaml	Both manifests grant Secrets get/create/update, ConfigMaps get, and Namespaces get. Permissions for pods, services, endpoints, persistent volume claims, events, and Apps workload resources are removed.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to 52d88

The PR narrows certman-operator permissions from cluster-wide wildcards to the documented access needed for secrets and configmaps. No actionable merge-blocking risk remains, so it is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: reducing certman-operator RBAC permissions to least privilege.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only two YAML ClusterRole files; the diff adds no Ginkgo test titles or dynamic test-name values.
Test Structure And Quality	✅ Passed	The commit changes only two RBAC YAML files and adds or modifies no Ginkgo tests, so the stated test-structure requirements do not apply.
Microshift Test Compatibility	✅ Passed	The commit changes only two RBAC YAML files; no new Ginkgo tests or test declarations were added, so MicroShift compatibility checks are not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The HEAD diff changes only two RBAC YAML files and adds no Ginkgo e2e tests, so SNO multi-node compatibility is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff changes only two ClusterRole RBAC manifests. No deployments, replicas, affinity, topology spread, node selectors, tolerations, or PDB scheduling constraints were introduced.
Ote Binary Stdout Contract	✅ Passed	The commit changes only two ClusterRole YAML files; it introduces no process-level stdout writes or changes to main, init, or suite setup.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only two YAML ClusterRole manifests. No Ginkgo test files or It/Describe/Context/When declarations changed, so this compatibility check is inapplicable.
No-Weak-Crypto	✅ Passed	The HEAD^..HEAD diff changes only two RBAC YAML files; introduced lines contain Kubernetes resources and verbs, with no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, or crypto code.
Container-Privileges	✅ Passed	The changed files are ClusterRole RBAC manifests and introduce no privileged container settings, host namespaces, SYS_ADMIN, root execution, or allowPrivilegeEscalation.
No-Sensitive-Data-In-Logs	✅ Passed	The pull request changes only Kubernetes RBAC manifests and adds no logging or log-output code that could expose sensitive data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: charlesgong

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [charlesgong]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.14%. Comparing base (ca5b1b7) to head (0487786).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #505   +/-   ##
=======================================
  Coverage   57.14%   57.14%           
=======================================
  Files          29       29           
  Lines        2170     2170           
=======================================
  Hits         1240     1240           
  Misses        812      812           
  Partials      118      118           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[charlesgong]

/retest

[openshift-ci]

@charlesgong: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.