Skip to content

Commit a0fcbde

Browse files
abyrne55claude
andauthored
[SREP-2115] Fix RBAC error by adding Secrets to cache configuration (#416)
* [SREP-2115] Fix RBAC error by adding Secrets to cache configuration This fixes the RBAC permission error: "failed to list *v1.Secret: secrets is forbidden: User 'system:serviceaccount:openshift-cloud-ingress-operator:cloud-ingress-operator' cannot list resource 'secrets' in API group '' at the cluster scope" Root cause: The operator accesses Secrets for cloud credentials (AWS/GCP) but Secrets were not explicitly configured in the controller-runtime cache. When a resource type is not in the cache's ByObject configuration, controller-runtime attempts to set up a cluster-wide watch/list. This fails because the operator only has namespace-scoped RBAC permissions for Secrets. Solution: Added corev1.Secret to the cache ByObject configuration with the same namespace restrictions as other resources. This ensures Secrets are only cached in the namespaces specified by WATCH_NAMESPACE, which includes openshift-cloud-ingress-operator where the credential secrets are stored. Fixes: SREP-2115 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * Update boilerplate to latest version Ran 'make boilerplate-update' to sync with latest boilerplate changes: - Updated OWNERS_ALIASES (removed Dee-6777) - Updated boilerplate metadata and tracking 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
1 parent 8d2f30e commit a0fcbde

File tree

4 files changed

+4
-3
lines changed

4 files changed

+4
-3
lines changed

OWNERS_ALIASES

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,6 @@ aliases:
6565
- feichashao
6666
- samanthajayasinghe
6767
- xiaoyu74
68-
- Dee-6777
6968
- Tessg22
7069
- smarthall
7170
srep-infra-cicd:
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
d7285a904eda6cf842ddff8c648dedb223934a75
1+
d34e59645cd877be62073b0df2ff91de2ea7659c

boilerplate/openshift/golang-osd-operator/OWNERS_ALIASES

Lines changed: 0 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

main.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,9 @@ func main() {
128128
&corev1.Service{}: {
129129
Namespaces: namespaces,
130130
},
131+
&corev1.Secret{}: {
132+
Namespaces: namespaces,
133+
},
131134
},
132135
},
133136
}

0 commit comments

Comments
 (0)