From f04f72530c05192566aba25306f5568b9928ecf8 Mon Sep 17 00:00:00 2001
From: Steve Baker <sbaker@redhat.com>
Date: Tue, 6 Oct 2026 14:43:17 +1300
Subject: [PATCH 1/2] Add rbac for ironic-operator creating namespaces

The graphical consoles feature will create the namespace
openstack-ironic-consoles which Ironic will use to create the graphical
console pods.

To do this, ironic-operator needs rbac rules to create (not delete)
namespaces. This is proposed as a standalone change because it needs to
be packaged in the openstack-operator bundle before ironic-operator can
use it.

Jira: OSPRH-20211
---
 config/rbac/role.yaml                             | 8 ++++++++
 internal/controller/ironicconductor_controller.go | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 89c0a055..f965609c 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -19,6 +19,14 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - create
+  - get
+  - patch
 - apiGroups:
   - ""
   resources:
diff --git a/internal/controller/ironicconductor_controller.go b/internal/controller/ironicconductor_controller.go
index 324f2bae..f02d114d 100644
--- a/internal/controller/ironicconductor_controller.go
+++ b/internal/controller/ironicconductor_controller.go
@@ -98,6 +98,8 @@ func (r *IronicConductorReconciler) GetLogger(ctx context.Context) logr.Logger {
 // service account permissions that are needed to grant permission to the above
 // +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid;privileged;nonroot-v2,resources=securitycontextconstraints,verbs=use
 // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update
+// rbac for creating the namespace that the graphical console pods will run in
+// +kubebuilder:rbac:groups=core,resources=namespaces,verbs=create;get;patch
 
 // Reconcile -
 func (r *IronicConductorReconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ctrl.Result, _err error) {

From 73edcacad46ed383367117b010fb097c19b3ba9e Mon Sep 17 00:00:00 2001
From: Steve Baker <sbaker@redhat.com>
Date: Wed, 7 Oct 2026 13:11:55 +1300
Subject: [PATCH 2/2] Expand RBAC pods permissions for graphical console
 support

The ironic-conductor controller creates namespace-scoped Roles that
grant pods management permissions (create, watch, update, patch,
delete) to the ironic service account. This is needed for graphical
console support, where the conductor manages console pods in a
separate namespace.

Kubernetes RBAC escalation prevention requires that the operator's
own ClusterRole holds all permissions it grants in any Role it
creates. The current ClusterRole only grants get and list on pods,
causing Role creation to be rejected with:

  roles.rbac.authorization.k8s.io is forbidden: user is attempting
  to grant RBAC permissions not currently held

Expand the pods verbs in the kubebuilder RBAC marker from get;list
to the full set needed by the created Roles.
---
 config/rbac/role.yaml                             | 8 +-------
 internal/controller/ironicconductor_controller.go | 2 +-
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index f965609c..26e8c2c1 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -9,6 +9,7 @@ rules:
   resources:
   - configmaps
   - persistentvolumeclaims
+  - pods
   - secrets
   - services
   verbs:
@@ -27,13 +28,6 @@ rules:
   - create
   - get
   - patch
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
 - apiGroups:
   - ""
   resources:
diff --git a/internal/controller/ironicconductor_controller.go b/internal/controller/ironicconductor_controller.go
index f02d114d..e36d845e 100644
--- a/internal/controller/ironicconductor_controller.go
+++ b/internal/controller/ironicconductor_controller.go
@@ -86,7 +86,7 @@ func (r *IronicConductorReconciler) GetLogger(ctx context.Context) logr.Logger {
 // +kubebuilder:rbac:groups=core,resources=persistentvolumeclaims,verbs=get;list;watch;create;update;delete;patch
 // +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;create;update;patch;delete;watch
 // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;create;update;patch;delete;watch
-// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list
+// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=operator.openshift.io,resources=ingresscontrollers,verbs=get;list
 // +kubebuilder:rbac:groups=k8s.cni.cncf.io,resources=network-attachment-definitions,verbs=get;list;watch
 // +kubebuilder:rbac:groups=route.openshift.io,resources=routes,verbs=get;list;watch;create;update;patch;delete