OCPBUGS-65504: machine-config ClusterOperator relatedObjects missing ClusterRoleBinding

[eric200428]

- What I did

• ClusterRoles and ClusterRoleBindings are cluster-scoped, so oc adm inspect doesn't automatically collect them when inspecting a namespace they were silently missing from must gather output.
• Added all MCO-owned RBAC resources to relatedObjects in both syncRelatedObjects() and initializeClusterOperator() in status.go, covering 8 ClusterRoles and 8 ClusterRoleBindings
• Mirrored the same list in the static ClusterOperator manifest (clusteroperator.yaml) so the install time object matches the runtime state.
• Added a unit test to assert all expected RBAC resources appear in relatedObjects after sync.

- How to verify it
Unit test:
run go test ./pkg/operator/ and confirm TestSyncRelatedObjectsContainsRBAC passes, which checks that all 8 ClusterRoles and 8 ClusterRoleBindings appear in relatedObjects after syncRelatedObjects() runs.

Live Cluster:

• deploying, run oc adm inspect clusteroperator/machine-config --dest-dir=/tmp/mco-inspect
• Then check that the output directory contains files for the RBAC resources:
  ls /tmp/mco-inspect/cluster-scoped-resources/rbac.authorization.k8s.io/
• You should see clusterroles/ and clusterrolebindings/ directories populated with MCO resources

- Description for the changelog
Add missing MCO ClusterRoles and ClusterRoleBindings to relatedObjects so oc adm inspect collects them

Summary by CodeRabbit

• Bug Fixes
  • Improved machine-config status reporting by including relevant cluster-scoped permissions and configuration resources.
  • Enhanced must-gather diagnostics with additional related objects for troubleshooting.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@eric200428: This pull request references Jira Issue OCPBUGS-65504, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @sergiordlr

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

- What I did

• ClusterRoles and ClusterRoleBindings are cluster-scoped, so oc adm inspect doesn't automatically collect them when inspecting a namespace they were silently missing from must gather output.
• Added all MCO-owned RBAC resources to relatedObjects in both syncRelatedObjects() and initializeClusterOperator() in status.go, covering 8 ClusterRoles and 8 ClusterRoleBindings
• Mirrored the same list in the static ClusterOperator manifest (clusteroperator.yaml) so the install time object matches the runtime state.
• Added a unit test to assert all expected RBAC resources appear in relatedObjects after sync.

- How to verify it
Unit test:
run go test ./pkg/operator/ and confirm TestSyncRelatedObjectsContainsRBAC passes, which checks that all 8 ClusterRoles and 8 ClusterRoleBindings appear in relatedObjects after syncRelatedObjects() runs.

Live Cluster:

• deploying, run oc adm inspect clusteroperator/machine-config --dest-dir=/tmp/mco-inspect
• Then check that the output directory contains files for the RBAC resources:
  ls /tmp/mco-inspect/cluster-scoped-resources/rbac.authorization.k8s.io/
• You should see clusterroles/ and clusterrolebindings/ directories populated with MCO resources

- Description for the changelog
Add missing MCO ClusterRoles and ClusterRoleBindings to relatedObjects so oc adm inspect collects them

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2c5dbeea-12ec-4091-989c-28e4c498eb13

📥 Commits

Reviewing files that changed from the base of the PR and between 513f906 and e543f61.

📒 Files selected for processing (3)

• install/0000_80_machine-config_06_clusteroperator.yaml
• pkg/operator/status.go
• pkg/operator/status_test.go

---

Walkthrough

The change adds MCO ClusterRoles and ClusterRoleBindings to the ClusterOperator related objects declared in installation manifests, status synchronization, and initial ClusterOperator creation. A test verifies the expected RBAC resources.

Changes

ClusterOperator related RBAC status

Layer / File(s)	Summary
Declare related resources install/0000_80_machine-config_06_clusteroperator.yaml	The manifest lists the machineconfigurations resource and MCO ClusterRoles and ClusterRoleBindings as related objects.
Report and validate RBAC objects pkg/operator/status.go, pkg/operator/status_test.go	Status synchronization and initial ClusterOperator creation include the MCO RBAC resources. The test verifies the expected ClusterRoles and ClusterRoleBindings.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the missing ClusterRoleBinding in the machine-config ClusterOperator relatedObjects, which is a primary change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR adds only the static, descriptive Go test name TestSyncRelatedObjectsContainsRBAC; it adds no dynamic Ginkgo title or run-dependent value.
Test Structure And Quality	✅ Passed	The added test is a pure standard Go/Testify unit test, not Ginkgo. It uses no cluster resources or waits, tests one related-object behavior, and has meaningful assertion messages.
Microshift Test Compatibility	✅ Passed	The only added test is the standard Go TestSyncRelatedObjectsContainsRBAC function; no new Ginkgo e2e tests were added, so MicroShift API compatibility rules do not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The only added test is the standard Go unit test TestSyncRelatedObjectsContainsRBAC in pkg/operator/status_test.go; no new Ginkgo e2e test or multi-node assumption exists.
Topology-Aware Scheduling Compatibility	✅ Passed	PR adds only metadata references to RBAC resources in ClusterOperator status. No pod deployments, scheduling constraints, affinity rules, topology assumptions, or replica count logic introduced.
Ote Binary Stdout Contract	✅ Passed	PR adds RBAC resources to ClusterOperator status manifest and code with no process-level stdout writes. Test is a standard unit test with no stdout violations.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds a plain Go unit test, not a Ginkgo e2e test; it contains no IPv4 assumptions or external connectivity.
No-Weak-Crypto	✅ Passed	The commit adds only RBAC object references and a list-membership test; added lines contain no weak crypto APIs, custom cryptography, or secret/token comparisons.
Container-Privileges	✅ Passed	The three changed files add only ClusterOperator relatedObjects and test code; no container securityContext or privilege fields such as privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allo...
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds only RBAC resource references to relatedObjects with no logging statements. Data added contains only standard Kubernetes object names, not sensitive information like passwords, tokens,...

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: eric200428
Once this PR has been reviewed and has the lgtm label, please assign ptalgulk01 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@eric200428: This pull request references Jira Issue OCPBUGS-65504, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @sergiordlr

Details

In response to this:

- What I did

• ClusterRoles and ClusterRoleBindings are cluster-scoped, so oc adm inspect doesn't automatically collect them when inspecting a namespace they were silently missing from must gather output.
• Added all MCO-owned RBAC resources to relatedObjects in both syncRelatedObjects() and initializeClusterOperator() in status.go, covering 8 ClusterRoles and 8 ClusterRoleBindings
• Mirrored the same list in the static ClusterOperator manifest (clusteroperator.yaml) so the install time object matches the runtime state.
• Added a unit test to assert all expected RBAC resources appear in relatedObjects after sync.

- How to verify it
Unit test:
run go test ./pkg/operator/ and confirm TestSyncRelatedObjectsContainsRBAC passes, which checks that all 8 ClusterRoles and 8 ClusterRoleBindings appear in relatedObjects after syncRelatedObjects() runs.

Live Cluster:

• deploying, run oc adm inspect clusteroperator/machine-config --dest-dir=/tmp/mco-inspect
• Then check that the output directory contains files for the RBAC resources:
  ls /tmp/mco-inspect/cluster-scoped-resources/rbac.authorization.k8s.io/
• You should see clusterroles/ and clusterrolebindings/ directories populated with MCO resources

- Description for the changelog
Add missing MCO ClusterRoles and ClusterRoleBindings to relatedObjects so oc adm inspect collects them

Summary by CodeRabbit

• Bug Fixes
• Improved machine-config status reporting by including relevant cluster-scoped permissions and configuration resources.
• Enhanced must-gather diagnostics with additional related objects for troubleshooting.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[eric200428]

/test bootstrap-unit

[umohnani8]

/pipeline required

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-ocl-part1
/test e2e-gcp-op-ocl-part2
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift
/test tls-pqc-readiness

[openshift-ci]

@eric200428: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-op-ocl-part2	e543f61	link	true	/test e2e-gcp-op-ocl-part2
ci/prow/perfscale-control-plane-6nodes	e543f61	link	false	/test perfscale-control-plane-6nodes

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.