From 52a0d3d45715adff38b07215d8d574b9642fab29 Mon Sep 17 00:00:00 2001 From: Paolo Dettori Date: Fri, 15 May 2026 16:49:21 -0400 Subject: [PATCH 1/2] fix(rbac): add sandboxes/finalizers permission for owner references MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The clientregistration and agentcardsync controllers create Secrets and AgentCards with blockOwnerDeletion owner references pointing to Sandbox CRs. OpenShift enforces that the controller SA must have update permission on the owner resource's finalizers subresource for this to succeed. Without it, the operator fails with: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on This was not caught on Kind (which does not enforce this check) but breaks Sandbox deployments on OpenShift. Add sandboxes/finalizers update permission to the kubebuilder markers, generated config/rbac, and the Helm chart ClusterRole — matching the existing pattern for deployments/finalizers and statefulsets/finalizers. Assisted-By: Claude (Anthropic AI) Signed-off-by: Paolo Dettori --- charts/kagenti-operator/templates/rbac/role.yaml | 6 ++++++ kagenti-operator/config/rbac/role.yaml | 6 ++++++ .../internal/controller/agentcardsync_controller.go | 1 + .../internal/controller/clientregistration_controller.go | 1 + 4 files changed, 14 insertions(+) diff --git a/charts/kagenti-operator/templates/rbac/role.yaml b/charts/kagenti-operator/templates/rbac/role.yaml index 93a12b11..22603c34 100755 --- a/charts/kagenti-operator/templates/rbac/role.yaml +++ b/charts/kagenti-operator/templates/rbac/role.yaml @@ -100,6 +100,12 @@ rules: - patch - update - watch +- apiGroups: + - agents.x-k8s.io + resources: + - sandboxes/finalizers + verbs: + - update - apiGroups: - agents.x-k8s.io resources: diff --git a/kagenti-operator/config/rbac/role.yaml b/kagenti-operator/config/rbac/role.yaml index 05fed7f9..e5bdc840 100644 --- a/kagenti-operator/config/rbac/role.yaml +++ b/kagenti-operator/config/rbac/role.yaml @@ -89,6 +89,12 @@ rules: - patch - update - watch +- apiGroups: + - agents.x-k8s.io + resources: + - sandboxes/finalizers + verbs: + - update - apiGroups: - agents.x-k8s.io resources: diff --git a/kagenti-operator/internal/controller/agentcardsync_controller.go b/kagenti-operator/internal/controller/agentcardsync_controller.go index 62fa280d..195124fb 100644 --- a/kagenti-operator/internal/controller/agentcardsync_controller.go +++ b/kagenti-operator/internal/controller/agentcardsync_controller.go @@ -57,6 +57,7 @@ type AgentCardSyncReconciler struct { // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch // +kubebuilder:rbac:groups=apps,resources=statefulsets/finalizers,verbs=update // +kubebuilder:rbac:groups=agents.x-k8s.io,resources=sandboxes,verbs=get;list;watch +// +kubebuilder:rbac:groups=agents.x-k8s.io,resources=sandboxes/finalizers,verbs=update func (r *AgentCardSyncReconciler) ReconcileDeployment(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { syncLogger.V(1).Info("Reconciling Deployment for auto-sync", "namespacedName", req.NamespacedName) diff --git a/kagenti-operator/internal/controller/clientregistration_controller.go b/kagenti-operator/internal/controller/clientregistration_controller.go index 832b8b3d..6c856aec 100644 --- a/kagenti-operator/internal/controller/clientregistration_controller.go +++ b/kagenti-operator/internal/controller/clientregistration_controller.go @@ -82,6 +82,7 @@ func (r *ClientRegistrationReconciler) uncachedReader() client.Reader { // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;update;patch // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;update;patch // +kubebuilder:rbac:groups=agents.x-k8s.io,resources=sandboxes,verbs=get;list;watch;update;patch +// +kubebuilder:rbac:groups=agents.x-k8s.io,resources=sandboxes/finalizers,verbs=update // +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch // +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch From efd9ffa23235a0a8ec7e2253e61deec6908e8afa Mon Sep 17 00:00:00 2001 From: Paolo Dettori Date: Fri, 15 May 2026 19:09:11 -0400 Subject: [PATCH 2/2] fix(rbac): add deployments/statefulsets finalizers markers to clientregistration controller Address review feedback: the clientregistration controller sets blockOwnerDeletion owner references on Deployments and StatefulSets too, so it needs the same finalizers markers that agentcardsync already has. Pre-existing gap surfaced during sandboxes/finalizers review. Assisted-By: Claude (Anthropic AI) Signed-off-by: Paolo Dettori --- .../internal/controller/clientregistration_controller.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kagenti-operator/internal/controller/clientregistration_controller.go b/kagenti-operator/internal/controller/clientregistration_controller.go index 6c856aec..182ac0aa 100644 --- a/kagenti-operator/internal/controller/clientregistration_controller.go +++ b/kagenti-operator/internal/controller/clientregistration_controller.go @@ -80,7 +80,9 @@ func (r *ClientRegistrationReconciler) uncachedReader() client.Reader { } // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;update;patch +// +kubebuilder:rbac:groups=apps,resources=deployments/finalizers,verbs=update // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;update;patch +// +kubebuilder:rbac:groups=apps,resources=statefulsets/finalizers,verbs=update // +kubebuilder:rbac:groups=agents.x-k8s.io,resources=sandboxes,verbs=get;list;watch;update;patch // +kubebuilder:rbac:groups=agents.x-k8s.io,resources=sandboxes/finalizers,verbs=update // +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch