OCPBUGS-65484: Add debug-useful ClusterOperator relatedObjects

[RadekManak]

Expand machine-approver ClusterOperator relatedObjects with RBAC that namespace inspect does not collect.

Keeps the existing namespace and CertificateSigningRequests entries.

Added relatedObjects

• ClusterRoles / ClusterRoleBindings: system:openshift:controller:machine-approver, system:openshift:controller:machine-approver-capi
• Role / RoleBinding: machine-approver in openshift-config-managed
• Roles / RoleBindings in openshift-cluster-machine-approver

Tests

Parity test keeping the Go list in sync with the ClusterOperator manifest.

Summary by CodeRabbit

• Bug Fixes

  • Improved ClusterOperator status reporting by including all relevant machine approver RBAC resources.
  • Added references for controller roles, bindings, and namespace-scoped permissions.

• Tests

  • Added validation to keep reported related resources consistent between deployment configuration and runtime status.

[openshift-ci-robot]

@RadekManak: This pull request references Jira Issue OCPBUGS-65484, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.21.0) matches configured target version for branch (4.21.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @sunzhaohua2

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This adds the system:openshift:controller:machine-approver ClusterRole to the ClusterOperator's relatedObjects to ensure it's collected by oc adm inspect and must-gather for debugging purposes.

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign radekmanak for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[wking]

Is a ClusterRole all you need? I'd expect you'd also need a ClusterRoleBinding that attaches that role to a ServiceAccount? And maybe other things?

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 80ce8195-dadc-4b0a-9bb7-a6a07596d9d0

📥 Commits

Reviewing files that changed from the base of the PR and between e078fff and 6470be8.

📒 Files selected for processing (4)

• go.mod
• manifests/05-clusteroperator.yaml
• related_objects_test.go
• status.go

🚧 Files skipped from review as they are similar to previous changes (3)

• related_objects_test.go
• status.go
• manifests/05-clusteroperator.yaml

---

Walkthrough

The PR expands ClusterOperator.status.relatedObjects with RBAC resources in code and the static manifest, then adds a test ensuring both lists remain synchronized.

Changes

Related objects synchronization

Layer / File(s)	Summary
Expand related object references status.go, manifests/05-clusteroperator.yaml	The controller and manifest now list machine-approver cluster roles, cluster role bindings, roles, and role bindings across the relevant namespaces.
Validate manifest synchronization related_objects_test.go, go.mod	A test compares the manifest’s related objects with the Go definition, and sigs.k8s.io/yaml is declared as a direct dependency.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: mdbooth, nrb, sunzhaohua2, theobarberbany

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: expanding ClusterOperator relatedObjects for debugging.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The only added Ginkgo title is a fixed string; no test names include dynamic or generated values.
Test Structure And Quality	✅ Passed	The new Ginkgo test is a single parity check, needs no cluster setup/cleanup, uses bounded expectations, and follows the package’s existing Ginkgo/Gomega style.
Microshift Test Compatibility	✅ Passed	The new Ginkgo spec is an envtest parity test that only reads YAML and compares slices; it doesn’t use live MicroShift-unsupported APIs/features.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The new Ginkgo test only reads the manifest and compares static relatedObjects; it makes no node/topology assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	Only relatedObjects/status-manifest sync changed; no pod specs, replicas, affinity, node selectors, or topology-dependent scheduling logic were added.
Ote Binary Stdout Contract	✅ Passed	No new process-level stdout writes were added; the PR only expands data and adds a Ginkgo spec. klog defaults to stderr in vendored klog.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The new Ginkgo test only reads a local manifest and compares YAML data; it has no IPv4 literals, IP parsing, or external network access.
No-Weak-Crypto	✅ Passed	Changed files only add RBAC relatedObjects and a parity test; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or secret comparison code found.
Container-Privileges	✅ Passed	Touched files only expand ClusterOperator relatedObjects and add a parity test; no privileged, hostPID/Network/IPC, SYS_ADMIN, or allowPrivilegeEscalation settings appear.
No-Sensitive-Data-In-Logs	✅ Passed	Added changes are RBAC/manifest parity only; no new logging statements or sensitive values were introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[damdo]

/remove-lifecycle rotten

[openshift-ci-robot]

@RadekManak: This pull request references Jira Issue OCPBUGS-65484, which is invalid:

• expected the bug to target either version "5.0." or "openshift-5.0.", but it targets "4.21.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Adds all resources managed by the machine-approver operator to the ClusterOperator's relatedObjects list, ensuring oc adm inspect and must-gather collect the complete set of resources needed for debugging.

Resources added

• ServiceAccounts
• Roles and RoleBindings (operator namespace and openshift-config-managed)
• ConfigMaps
• Services, Deployments
• ServiceMonitors and PrometheusRules

Both the static manifest YAML and the Go source are kept in sync.

Summary by CodeRabbit

• Improvements
• Enhanced cluster operator status reporting with expanded tracking of related cluster resources, RBAC components, and configuration-managed elements across all relevant namespaces for better visibility into resource relationships.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@related_objects_test.go`:
- Around line 13-22: Add an explicit expected complete set of related objects in
the relatedObjects test, and assert that relatedObjects equals this set
independently of the manifest contents. Retain the existing manifest unmarshal
and equality assertion so the test still detects drift between relatedObjects
and manifests/05-clusteroperator.yaml.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 8b6723fd-d64e-486e-92c1-9c9f44efdbaf

📥 Commits

Reviewing files that changed from the base of the PR and between b02fadd and e078fff.

📒 Files selected for processing (3)

• manifests/05-clusteroperator.yaml
• related_objects_test.go
• status.go

🚧 Files skipped from review as they are similar to previous changes (1)

• manifests/05-clusteroperator.yaml

[RadekManak]

/hold cancel

[openshift-ci-robot]

@RadekManak: This pull request references Jira Issue OCPBUGS-65484, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @sunzhaohua2

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Expand machine-approver ClusterOperator relatedObjects with RBAC that namespace inspect does not collect.

Keeps the existing namespace and CertificateSigningRequests entries.

Added relatedObjects

• ClusterRoles / ClusterRoleBindings: system:openshift:controller:machine-approver, system:openshift:controller:machine-approver-capi
• Role / RoleBinding: machine-approver in openshift-config-managed
• Roles / RoleBindings in openshift-cluster-machine-approver

Tests

Parity test keeping the Go list in sync with the ClusterOperator manifest.

Summary by CodeRabbit

• Bug Fixes

• Improved ClusterOperator status reporting by including all relevant machine approver RBAC resources.

• Added references for controller roles, bindings, and namespace-scoped permissions.

• Tests

• Added validation to keep reported related resources consistent between deployment configuration and runtime status.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: sunzhaohua2.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

@RadekManak: This pull request references Jira Issue OCPBUGS-65484, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @sunzhaohua2

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Expand machine-approver ClusterOperator relatedObjects with RBAC that namespace inspect does not collect.

Keeps the existing namespace and CertificateSigningRequests entries.

Added relatedObjects

• ClusterRoles / ClusterRoleBindings: system:openshift:controller:machine-approver, system:openshift:controller:machine-approver-capi
• Role / RoleBinding: machine-approver in openshift-config-managed
• Roles / RoleBindings in openshift-cluster-machine-approver

Tests

Parity test keeping the Go list in sync with the ClusterOperator manifest.

Summary by CodeRabbit

• Bug Fixes

• Improved ClusterOperator status reporting by including all relevant machine approver RBAC resources.

• Added references for controller roles, bindings, and namespace-scoped permissions.

• Tests

• Added validation to keep reported related resources consistent between deployment configuration and runtime status.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[RadekManak]

/retest-required

[openshift-ci]

@RadekManak: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-techpreview-post-install	6470be8	link	true	/test e2e-aws-techpreview-post-install

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.