From 6652404b9d64b695a855c7c8500ee10015b99be1 Mon Sep 17 00:00:00 2001 From: Rui Vieira Date: Sat, 1 Aug 2026 12:28:57 +0100 Subject: [PATCH 1/2] chore(rbac): add events:create and jobs:patch/get permissions for EvalHub ServiceAccount Add two new ClusterRoles for the EvalHub ServiceAccount: - evalhub-events: grants events create, so the EvalHub server can emit Kubernetes Events against backing Job resources on evaluation lifecycle transitions (EvaluationStarted, EvaluationCompleted, EvaluationFailed, EvaluationThresholdViolated) - evalhub-jobs-writer extended with get and patch verbs, so the server can read-modify-patch the trustyai.opendatahub.io/evaluation-phase label on running Jobs Both new ClusterRoleBindings are added to the OPA policy allowlist. No functional code changes; this is the RBAC prerequisite for RHAI-277. --- config/components/evalhub/kustomization.yaml | 2 ++ .../evalhub/rbac/evalhub_events_binding.yaml | 15 +++++++++++++++ .../evalhub/rbac/evalhub_events_role.yaml | 17 +++++++++++++++++ .../evalhub/rbac/evalhub_jobs_writer_role.yaml | 2 +- policy/rbac.rego | 2 ++ 5 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 config/components/evalhub/rbac/evalhub_events_binding.yaml create mode 100644 config/components/evalhub/rbac/evalhub_events_role.yaml diff --git a/config/components/evalhub/kustomization.yaml b/config/components/evalhub/kustomization.yaml index c1eae6574..97524250b 100644 --- a/config/components/evalhub/kustomization.yaml +++ b/config/components/evalhub/kustomization.yaml @@ -6,6 +6,8 @@ resources: - crd/trustyai.opendatahub.io_evalhubs.yaml - rbac/evalhub_auth_reviewer_role.yaml - rbac/evalhub_collections_access_binding.yaml + - rbac/evalhub_events_binding.yaml + - rbac/evalhub_events_role.yaml - rbac/evalhub_collections_access_role.yaml - rbac/evalhub_hardware_profiles_reader_role.yaml - rbac/evalhub_job_config_binding.yaml diff --git a/config/components/evalhub/rbac/evalhub_events_binding.yaml b/config/components/evalhub/rbac/evalhub_events_binding.yaml new file mode 100644 index 000000000..998d5909c --- /dev/null +++ b/config/components/evalhub/rbac/evalhub_events_binding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/component: evalhub + app.kubernetes.io/name: trustyai-service-operator + name: evalhub-events-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: evalhub-events +subjects: +- kind: ServiceAccount + name: controller-manager + namespace: system diff --git a/config/components/evalhub/rbac/evalhub_events_role.yaml b/config/components/evalhub/rbac/evalhub_events_role.yaml new file mode 100644 index 000000000..7dc0b52f4 --- /dev/null +++ b/config/components/evalhub/rbac/evalhub_events_role.yaml @@ -0,0 +1,17 @@ +--- +# ClusterRole for EvalHub event emission +# Grants create on core events so the EvalHub server can emit Kubernetes +# Events against backing Job resources on evaluation lifecycle transitions +# (EvaluationStarted, EvaluationCompleted, EvaluationFailed, EvaluationThresholdViolated). +# Split from evalhub-jobs-writer for least-privilege. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: evalhub-events + labels: + app.kubernetes.io/name: trustyai-service-operator + app.kubernetes.io/component: evalhub +rules: + - apiGroups: [""] + resources: ["events"] + verbs: ["create"] diff --git a/config/components/evalhub/rbac/evalhub_jobs_writer_role.yaml b/config/components/evalhub/rbac/evalhub_jobs_writer_role.yaml index 46fadbba6..4807c7018 100644 --- a/config/components/evalhub/rbac/evalhub_jobs_writer_role.yaml +++ b/config/components/evalhub/rbac/evalhub_jobs_writer_role.yaml @@ -11,4 +11,4 @@ metadata: rules: - apiGroups: ["batch"] resources: ["jobs"] - verbs: ["create", "delete", "list"] + verbs: ["create", "delete", "get", "list", "patch"] diff --git a/policy/rbac.rego b/policy/rbac.rego index d40bfff3c..1e780c3dd 100644 --- a/policy/rbac.rego +++ b/policy/rbac.rego @@ -31,6 +31,7 @@ expected_crbs := { # --- component: evalhub (prefixed overlays: odh, rhoai, dev, testing) --- "trustyai-service-operator-evalhub-manager-rolebinding": "trustyai-service-operator-evalhub-manager-role", + "trustyai-service-operator-evalhub-events-binding": "trustyai-service-operator-evalhub-events", "trustyai-service-operator-evalhub-collections-access-binding": "trustyai-service-operator-evalhub-collections-access", "trustyai-service-operator-evalhub-providers-access-binding": "trustyai-service-operator-evalhub-providers-access", "trustyai-service-operator-evalhub-mlflow-access-binding": "trustyai-service-operator-evalhub-mlflow-access", @@ -40,6 +41,7 @@ expected_crbs := { # --- component: evalhub (un-prefixed overlay: evalhub-only) --- "evalhub-manager-rolebinding": "trustyai-service-operator-evalhub-manager-role", + "evalhub-events-binding": "evalhub-events", "evalhub-collections-access-binding": "evalhub-collections-access", "evalhub-providers-access-binding": "evalhub-providers-access", "evalhub-mlflow-access-binding": "evalhub-mlflow-access", From 44057666f1c333141332b9572c55a2c9408b4fde Mon Sep 17 00:00:00 2001 From: Rui Vieira Date: Sat, 1 Aug 2026 13:25:09 +0100 Subject: [PATCH 2/2] fix(rbac): add patch verb to evalhub-events ClusterRole for EventRecorder deduplication --- config/components/evalhub/rbac/evalhub_events_role.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/components/evalhub/rbac/evalhub_events_role.yaml b/config/components/evalhub/rbac/evalhub_events_role.yaml index 7dc0b52f4..d56ebd404 100644 --- a/config/components/evalhub/rbac/evalhub_events_role.yaml +++ b/config/components/evalhub/rbac/evalhub_events_role.yaml @@ -14,4 +14,4 @@ metadata: rules: - apiGroups: [""] resources: ["events"] - verbs: ["create"] + verbs: ["create", "patch"]