fix(rbac): add sandboxes/finalizers permission for owner references - #363
Merged
Conversation
The clientregistration and agentcardsync controllers create Secrets and AgentCards with blockOwnerDeletion owner references pointing to Sandbox CRs. OpenShift enforces that the controller SA must have update permission on the owner resource's finalizers subresource for this to succeed. Without it, the operator fails with: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on This was not caught on Kind (which does not enforce this check) but breaks Sandbox deployments on OpenShift. Add sandboxes/finalizers update permission to the kubebuilder markers, generated config/rbac, and the Helm chart ClusterRole — matching the existing pattern for deployments/finalizers and statefulsets/finalizers. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Paolo Dettori <dettori@us.ibm.com>
cwiklik
approved these changes
May 15, 2026
cwiklik
left a comment
cwiklik
left a comment
Collaborator
There was a problem hiding this comment.
Clean RBAC fix — adds sandboxes/finalizers update permission matching the existing deployments/finalizers and statefulsets/finalizers pattern. Kubebuilder markers, generated config/rbac, and Helm chart are all consistent. One pre-existing gap noted below.
Areas reviewed: Go (kubebuilder markers), Helm/K8s (RBAC), YAML
Commits: 1 commit, signed-off: yes
CI status: all passing (E2E pending)
…egistration controller Address review feedback: the clientregistration controller sets blockOwnerDeletion owner references on Deployments and StatefulSets too, so it needs the same finalizers markers that agentcardsync already has. Pre-existing gap surfaced during sandboxes/finalizers review. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Paolo Dettori <dettori@us.ibm.com>
Member
Author
|
Addressed: added |
github-project-automation
Bot
moved this from Backlog
to Done
in Rossoctl Issue Prioritization
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sandboxes/finalizersupdate permission to the operator ClusterRolecannot set blockOwnerDeletionerrorsconfig/rbac/role.yaml, and Helm chartProblem
The
clientregistrationandagentcardsynccontrollers create Secrets and AgentCards withblockOwnerDeletionowner references pointing to Sandbox CRs. OpenShift enforces that the controller service account must haveupdatepermission on the owner resource'sfinalizerssubresource. Without it:This was not caught on Kind (which does not enforce this RBAC check) but breaks all Sandbox-type agent deployments on OpenShift.
Changes
clientregistration_controller.go+kubebuilder:rbacmarker forsandboxes/finalizersagentcardsync_controller.go+kubebuilder:rbacmarker forsandboxes/finalizersconfig/rbac/role.yamlcharts/.../rbac/role.yamlFollows the existing pattern for
deployments/finalizersandstatefulsets/finalizers.Test plan
Assisted-By: Claude Code