Add watch to ImageContentSourcePolicy permissions

Adding the watch permission will suppress the large number of errors being reported by the openstack-operator related to watching ICSP objects. Jira: https://issues.redhat.com/browse/OSPRH-12713 Signed-off-by: Brendan Shephard <[email protected]>
openstack-k8s-operators · Jan 3, 2025 · c4a50c9 · c4a50c9
1 parent 6aafc22
commit c4a50c9
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -661,6 +661,7 @@ rules:
   verbs:
   - get
   - list
+  - watch
 - apiGroups:
   - ovn.openstack.org
   resources:

diff --git a/controllers/dataplane/openstackdataplanenodeset_controller.go b/controllers/dataplane/openstackdataplanenodeset_controller.go
@@ -123,7 +123,7 @@ func (r *OpenStackDataPlaneNodeSetReconciler) GetLogger(ctx context.Context) log
 // +kubebuilder:rbac:groups="image.openshift.io",resources=imagestreamtags,verbs=get;list;watch
 
 // RBAC for ImageContentSourcePolicy and MachineConfig
-// +kubebuilder:rbac:groups="operator.openshift.io",resources=imagecontentsourcepolicies,verbs=get;list
+// +kubebuilder:rbac:groups="operator.openshift.io",resources=imagecontentsourcepolicies,verbs=get;list;watch
 // +kubebuilder:rbac:groups="machineconfiguration.openshift.io",resources=machineconfigs,verbs=get;list;watch
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
-Original file line number
+Diff line change
@@ Expand Up / @@ -661,6 +661,7 @@ rules: @@
       verbs:
       - get
       - list
+      - watch
     - apiGroups:
       - ovn.openstack.org
       resources:
@@ Expand Down @@