OCPBUGS-65504: machine-config ClusterOperator relatedObjects missing ClusterRoleBinding

[eric200428]

- What I did

• ClusterRoles and ClusterRoleBindings are cluster-scoped, so oc adm inspect doesn't automatically collect them when inspecting a namespace they were silently missing from must gather output.
• Added all MCO-owned RBAC resources to relatedObjects in both syncRelatedObjects() and initializeClusterOperator() in status.go, covering 8 ClusterRoles and 8 ClusterRoleBindings
• Mirrored the same list in the static ClusterOperator manifest (clusteroperator.yaml) so the install time object matches the runtime state.
• Added a unit test to assert all expected RBAC resources appear in relatedObjects after sync.

- How to verify it
Unit test:
run go test ./pkg/operator/ and confirm TestSyncRelatedObjectsContainsRBAC passes, which checks that all 8 ClusterRoles and 8 ClusterRoleBindings appear in relatedObjects after syncRelatedObjects() runs.

Live Cluster:

• deploying, run oc adm inspect clusteroperator/machine-config --dest-dir=/tmp/mco-inspect
• Then check that the output directory contains files for the RBAC resources:
  ls /tmp/mco-inspect/cluster-scoped-resources/rbac.authorization.k8s.io/
• You should see clusterroles/ and clusterrolebindings/ directories populated with MCO resources

- Description for the changelog
Add missing MCO ClusterRoles and ClusterRoleBindings to relatedObjects so oc adm inspect collects them

Summary by CodeRabbit

• Bug Fixes
  • Improved machine-config status reporting by including relevant cluster-scoped permissions and configuration resources.
  • Enhanced must-gather diagnostics with additional related objects for troubleshooting.
  • Improved visibility into machine-config components and their associated access resources during cluster health reviews and support investigations.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@eric200428: This pull request references Jira Issue OCPBUGS-65504, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @sergiordlr

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

- What I did

• ClusterRoles and ClusterRoleBindings are cluster-scoped, so oc adm inspect doesn't automatically collect them when inspecting a namespace they were silently missing from must gather output.
• Added all MCO-owned RBAC resources to relatedObjects in both syncRelatedObjects() and initializeClusterOperator() in status.go, covering 8 ClusterRoles and 8 ClusterRoleBindings
• Mirrored the same list in the static ClusterOperator manifest (clusteroperator.yaml) so the install time object matches the runtime state.
• Added a unit test to assert all expected RBAC resources appear in relatedObjects after sync.

- How to verify it
Unit test:
run go test ./pkg/operator/ and confirm TestSyncRelatedObjectsContainsRBAC passes, which checks that all 8 ClusterRoles and 8 ClusterRoleBindings appear in relatedObjects after syncRelatedObjects() runs.

Live Cluster:

• deploying, run oc adm inspect clusteroperator/machine-config --dest-dir=/tmp/mco-inspect
• Then check that the output directory contains files for the RBAC resources:
  ls /tmp/mco-inspect/cluster-scoped-resources/rbac.authorization.k8s.io/
• You should see clusterroles/ and clusterrolebindings/ directories populated with MCO resources

- Description for the changelog
Add missing MCO ClusterRoles and ClusterRoleBindings to relatedObjects so oc adm inspect collects them

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 94e75264-bd06-4132-96ed-8cb3087be604

📥 Commits

Reviewing files that changed from the base of the PR and between 13ea39a and b9b675e.

📒 Files selected for processing (3)

• install/0000_80_machine-config_06_clusteroperator.yaml
• pkg/operator/status.go
• pkg/operator/status_test.go

🚧 Files skipped from review as they are similar to previous changes (3)

• pkg/operator/status_test.go
• pkg/operator/status.go
• install/0000_80_machine-config_06_clusteroperator.yaml

---

Walkthrough

The change adds MCO ClusterRoles and ClusterRoleBindings to ClusterOperator related objects in the installation manifest, status synchronization, and initial ClusterOperator creation. A test verifies the expected RBAC resources.

Changes

ClusterOperator related RBAC status

Layer / File(s)	Summary
Declare related RBAC resources install/0000_80_machine-config_06_clusteroperator.yaml	The manifest lists the machineconfigurations resource and MCO ClusterRoles and ClusterRoleBindings as related objects.
Synchronize and validate RBAC resources pkg/operator/status.go, pkg/operator/status_test.go	Status synchronization and initial ClusterOperator creation include the MCO RBAC resources. The test verifies the expected ClusterRoles and ClusterRoleBindings.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: pablintino, sergiordlr

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title identifies the tracked issue and clearly states the primary change: adding the missing machine-config ClusterRoleBinding to ClusterOperator relatedObjects.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The added test is a standard Go test with the static name TestSyncRelatedObjectsContainsRBAC; it contains no Ginkgo title or dynamic value.
Test Structure And Quality	✅ Passed	The added test uses standard testing, not Ginkgo. It creates no cluster resources, performs no waits, and both ElementsMatch assertions include diagnostic messages.
Microshift Test Compatibility	✅ Passed	The pull request adds a standard Go unit test, not a Ginkgo e2e test. No new It, Describe, Context, or When test uses MicroShift-unavailable APIs.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only YAML and pkg/operator Go files; it adds a standard unit test, not a new Ginkgo e2e test, so SNO compatibility review is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The patch only adds RBAC ObjectReferences to ClusterOperator status, the static manifest, and a test; it adds no replicas, affinity, topology spread, selectors, tolerations, or PDB constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes no OTE code; its OTE main and BeforeAll setup have no stdout writes, and existing CLI prints are test-case helpers.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo e2e tests added in this PR. The single test added (TestSyncRelatedObjectsContainsRBAC) is a standard Go unit test with no IPv4 assumptions or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The 129 added lines contain only RBAC references and resource-name assertions; audits found no MD5, SHA-1, DES, RC4, Blowfish, ECB, crypto APIs, custom crypto, or secret/token comparisons.
Container-Privileges	✅ Passed	The patch adds only ClusterOperator relatedObjects references and tests. No changed manifest contains privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The patch adds only related-object entries, comments, and a unit test; no new logging calls or log formatting expose passwords, tokens, PII, hostnames, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: eric200428
Once this PR has been reviewed and has the lgtm label, please assign ptalgulk01 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@eric200428: This pull request references Jira Issue OCPBUGS-65504, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @sergiordlr

Details

In response to this:

- What I did

• ClusterRoles and ClusterRoleBindings are cluster-scoped, so oc adm inspect doesn't automatically collect them when inspecting a namespace they were silently missing from must gather output.
• Added all MCO-owned RBAC resources to relatedObjects in both syncRelatedObjects() and initializeClusterOperator() in status.go, covering 8 ClusterRoles and 8 ClusterRoleBindings
• Mirrored the same list in the static ClusterOperator manifest (clusteroperator.yaml) so the install time object matches the runtime state.
• Added a unit test to assert all expected RBAC resources appear in relatedObjects after sync.

- How to verify it
Unit test:
run go test ./pkg/operator/ and confirm TestSyncRelatedObjectsContainsRBAC passes, which checks that all 8 ClusterRoles and 8 ClusterRoleBindings appear in relatedObjects after syncRelatedObjects() runs.

Live Cluster:

• deploying, run oc adm inspect clusteroperator/machine-config --dest-dir=/tmp/mco-inspect
• Then check that the output directory contains files for the RBAC resources:
  ls /tmp/mco-inspect/cluster-scoped-resources/rbac.authorization.k8s.io/
• You should see clusterroles/ and clusterrolebindings/ directories populated with MCO resources

- Description for the changelog
Add missing MCO ClusterRoles and ClusterRoleBindings to relatedObjects so oc adm inspect collects them

Summary by CodeRabbit

• Bug Fixes
• Improved machine-config status reporting by including relevant cluster-scoped permissions and configuration resources.
• Enhanced must-gather diagnostics with additional related objects for troubleshooting.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[eric200428]

/test bootstrap-unit

[umohnani8]

/pipeline required

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-ocl-part1
/test e2e-gcp-op-ocl-part2
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift
/test tls-pqc-readiness

[eric200428]

/retest

[eric200428]

/test e2e-gcp-op-ocl-part2

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[eric200428]

/test bootstrap-unit

[eric200428]

/pipeline required

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-ocl-part1
/test e2e-gcp-op-ocl-part2
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift
/test tls-pqc-readiness

[openshift-ci]

@eric200428: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/perfscale-control-plane-6nodes	b9b675e	link	false	/test perfscale-control-plane-6nodes

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[eric200428]

/retest-required