From d59a9261f1350932368885be5b6f1b61e89776a3 Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Wed, 29 Jul 2026 12:55:21 +0100 Subject: [PATCH 1/2] CMP-4496: Add NetworkPolicy RBAC for operands to operator Role and CSV --- .../compliance-operator.clusterserviceversion.yaml | 9 +++++++++ .../bases/compliance-operator.clusterserviceversion.yaml | 9 +++++++++ config/rbac/operator_role.yaml | 9 +++++++++ 3 files changed, 27 insertions(+) diff --git a/bundle/manifests/compliance-operator.clusterserviceversion.yaml b/bundle/manifests/compliance-operator.clusterserviceversion.yaml index cf831c2d08..0e97324b0d 100644 --- a/bundle/manifests/compliance-operator.clusterserviceversion.yaml +++ b/bundle/manifests/compliance-operator.clusterserviceversion.yaml @@ -1590,6 +1590,15 @@ spec: - get - list - watch + - apiGroups: + - networking.k8s.io + resources: + - networkpolicies + verbs: + - create + - delete + - get + - update serviceAccountName: compliance-operator - rules: - apiGroups: diff --git a/config/manifests/bases/compliance-operator.clusterserviceversion.yaml b/config/manifests/bases/compliance-operator.clusterserviceversion.yaml index 5acf97db4e..2c5e8d91a2 100644 --- a/config/manifests/bases/compliance-operator.clusterserviceversion.yaml +++ b/config/manifests/bases/compliance-operator.clusterserviceversion.yaml @@ -1412,6 +1412,15 @@ spec: - get - list - watch + - apiGroups: + - networking.k8s.io + resources: + - networkpolicies + verbs: + - create + - delete + - get + - update serviceAccountName: compliance-operator - rules: - apiGroups: diff --git a/config/rbac/operator_role.yaml b/config/rbac/operator_role.yaml index 36ef1a7fba..022a95cbca 100644 --- a/config/rbac/operator_role.yaml +++ b/config/rbac/operator_role.yaml @@ -137,3 +137,12 @@ rules: - get - list - watch + - apiGroups: + - networking.k8s.io + resources: + - networkpolicies + verbs: + - create + - delete + - get + - update From 529958f799d867a1b9b88e1b6e1ac78c74f9498d Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Wed, 29 Jul 2026 13:23:43 +0100 Subject: [PATCH 2/2] CMP-4496: Add kubebuilder RBAC marker for NetworkPolicy permissions --- pkg/controller/compliancescan/compliancescan_controller.go | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/controller/compliancescan/compliancescan_controller.go b/pkg/controller/compliancescan/compliancescan_controller.go index de9fdde3f9..dc5cc8190c 100644 --- a/pkg/controller/compliancescan/compliancescan_controller.go +++ b/pkg/controller/compliancescan/compliancescan_controller.go @@ -124,6 +124,7 @@ type ReconcileComplianceScan struct { //+kubebuilder:rbac:groups=batch,resources=cronjobs,verbs=get,list,watch,create,delete,update //+kubebuilder:rbac:groups=batch,resources=jobs,verbs=deletecollection //+kubebuilder:rbac:groups=image.openshift.io,resources=imagestreamtags,verbs=get,list,watch +//+kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=create,delete,get,update //+kubebuilder:rbac:groups=scheduling.k8s.io,resources=priorityclasses,verbs=get,list,watch //+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=clusterclaims,verbs=get,list,watch //+kubebuilder:rbac:groups=config.openshift.io,resources=infrastructures,verbs=get,list,watch