:bug: make create verb a fixed namespaced collection verb for preflight checks by kuiwang02 · Pull Request #2587 · operator-framework/operator-controller

kuiwang02 · 2026-03-24T05:30:50Z

Summary

Makes the create verb a fixed default for namespaced collection verbs in RBAC preflight checks, ensuring consistent permission validation across all appliers (Boxcutter and Helm).

Problem

PR #2539 introduced configurable namespace-scoped collection verbs for preflight permission checks. However:

The Boxcutter applier was missing the WithNamespacedCollectionVerbs("create") configuration
This caused preflight checks to pass without validating CREATE permissions
Installations failed when the applier attempted to create resources like ServiceAccounts

Original issue: Only Boxcutter was affected because Helm had the correct configuration.

Approach Change (Per @perdasilva's Suggestion)

Following feedback from @perdasilva, this PR uses a broader approach instead of just adding the missing configuration to Boxcutter:

Instead of requiring each applier to explicitly call WithNamespacedCollectionVerbs("create"),
We now define namespacedCollectionVerbs as a fixed variable (similar to objectVerbs) and initialize it by default in NewRBACPreAuthorizer.

Related Issues

Assisted-By: Claude Code

netlify · 2026-03-24T05:30:56Z

✅ Deploy Preview for olmv1 ready!

Name	Link
🔨 Latest commit	`42bc39a`
🔍 Latest deploy log	https://app.netlify.com/projects/olmv1/deploys/69ca37ec7a49fd0008cee0d7
😎 Deploy Preview	https://deploy-preview-2587--olmv1.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Pull request overview

This PR fixes Boxcutter applier preflight RBAC validation so it correctly checks for namespace-scoped CREATE permissions, preventing installs from passing preflight but failing later when creating namespaced resources (e.g., ServiceAccounts).

Changes:

Configure Boxcutter’s RBACPreAuthorizer with WithNamespacedCollectionVerbs("create") under the PreflightPermissions feature gate.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

kuiwang02 · 2026-03-24T05:37:09Z

/cc @perdasilva

codecov · 2026-03-24T05:50:24Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.86%. Comparing base (a307a6d) to head (42bc39a).
⚠️ Report is 17 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #2587 +/- ##
==========================================
+ Coverage 65.84% 68.86% +3.01% 
==========================================
Files 137 139 +2 Lines 9560 9872 +312 ==========================================
+ Hits 6295 6798 +503 + Misses 2795 2557 -238 - Partials 470 517 +47

Flag	Coverage Δ
e2e	`37.75% <0.00%> (+26.56%)`	⬆️
experimental-e2e	`52.43% <100.00%> (+1.37%)`	⬆️
unit	`53.51% <100.00%> (+0.71%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

fgiudici

LGTM. Good catch!

pedjak

please add e2e tests that assert the change.

kuiwang02 · 2026-03-25T01:58:29Z

LGTM. Good catch!

@fgiudici Thanks!

kuiwang02 · 2026-03-25T01:59:16Z

please add e2e tests that assert the change.

@pedjak I add e2e cases for the change and it passes. could you please review it again? Thanks

tmshort · 2026-03-25T19:02:42Z

/approve

kuiwang02 · 2026-03-25T23:55:49Z

@pedjak could you please review it again? thanks.

jianzhangbjz · 2026-03-27T01:32:25Z

/lgtm

tmshort · 2026-03-27T03:04:16Z

ping @pedjak

pedjak · 2026-03-27T07:06:53Z

@@ -0,0 +1,68 @@
+---


this file is not needed, because we execute the new test only with boxcutter runtime.

done, thanks

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tmshort · 2026-03-27T13:32:25Z

@pedjak you'll have to remove your "Changes Requested" for this PR to advance (even if it has an LGTM).
@perdasilva it appears as though updates were made.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

kuiwang02 · 2026-03-30T06:35:04Z

@perdasilva Following your feedback, this PR now uses a different approach:

Instead of requiring each applier to explicitly call WithNamespacedCollectionVerbs("create"), we now define namespaceCollectionVerbs as a fixed variable (similar to objectVerbs) and initialize it by default in NewRBACPreAuthorizer.

please help review it again. thanks

perdasilva · 2026-03-30T07:30:25Z

+ authorizer: newRBACAuthorizer(cl),
+ ruleResolver: newRBACRulesResolver(cl),
+ restMapper: cl.RESTMapper(),
+ namespacedCollectionVerbs: slices.Clone(namespacedCollectionVerbs),


let's remove this field from the struct and just reference namespacedCollectionVerbs directly like we do with objectVerbs. Wdyt?

@perdasilva based on your comment, I make the change https://github.com/operator-framework/operator-controller/compare/3860ac5bf8ecbcf0207138793f3a9c74df9ce231..42bc39a00af0f6e6c11df5fa6e4a38b0ea2dac6f and the test is failing (before this change, the test is ok)
But I do not find root cause on why it is failing (I do not think the changed code cause it). so, I want to rerun test. but I do not know how to rerun it. could you please help me to rerun the test job? thanks

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

kuiwang02 · 2026-03-30T09:42:01Z

/retest-required

perdasilva · 2026-03-30T10:49:30Z

/approve

kuiwang02 · 2026-03-30T10:51:27Z

/test experimental-e2e

openshift-ci · 2026-03-30T10:51:31Z

@kuiwang02: No presubmit jobs available for operator-framework/operator-controller@main

Details

In response to this:

/test experimental-e2e

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

kuiwang02 · 2026-03-30T10:52:24Z

/retest

pedjak

/approve

rashmigottipati

/lgtm

openshift-ci · 2026-03-30T12:13:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fgiudici, pedjak, perdasilva, rashmigottipati, tmshort

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [pedjak,perdasilva,tmshort]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

CopilotAI review requested due to automatic review settings March 24, 2026 05:30

openshift-ciBot requested review from pedjak and trgeiger March 24, 2026 05:30

Copilotstarted reviewing on behalf of kuiwang02 March 24, 2026 05:31 View session

CopilotAI reviewed Mar 24, 2026
View reviewed changes

kuiwang02 changed the title ~~🐛add create verb to boxcutter preflight~~ 🐛 add create verb to boxcutter preflightMar 24, 2026

kuiwang02 changed the title ~~🐛 add create verb to boxcutter preflight~~Patch fix: 🐛 (:bug:) add create verb to boxcutter preflightMar 24, 2026

kuiwang02 changed the title ~~Patch fix: 🐛 (:bug:) add create verb to boxcutter preflight~~🐛 add create verb to boxcutter preflightMar 24, 2026

openshift-ciBot requested a review from perdasilva March 24, 2026 05:37

fgiudici approved these changes Mar 24, 2026
View reviewed changes

openshift-ciBot assigned fgiudici Mar 24, 2026

openshift-ciBot added the lgtm Indicates that a PR is ready to be merged. label Mar 24, 2026

pedjak requested changes Mar 24, 2026
View reviewed changes

openshift-ciBot assigned pedjak Mar 24, 2026

openshift-ciBot removed the lgtm Indicates that a PR is ready to be merged. label Mar 24, 2026

kuiwang02 force-pushed the fix78211 branch from f553c5d to 01437c5Compare March 25, 2026 01:34

openshift-ciBot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 25, 2026

kuiwang02 requested a review from pedjak March 25, 2026 23:54

openshift-ciBot assigned jianzhangbjz Mar 27, 2026

openshift-ciBot added the lgtm Indicates that a PR is ready to be merged. label Mar 27, 2026

pedjak reviewed Mar 27, 2026
View reviewed changes

Copilotstarted reviewing on behalf of kuiwang02 March 27, 2026 09:07 View session

CopilotAI reviewed Mar 27, 2026
View reviewed changes

Comment threadtest/e2e/steps/steps.go

kuiwang02 force-pushed the fix78211 branch from e611b63 to 99fe9fcCompare March 27, 2026 09:35

CopilotAI review requested due to automatic review settings March 30, 2026 06:27

kuiwang02 force-pushed the fix78211 branch from 99fe9fc to a949d7eCompare March 30, 2026 06:27

Copilotstarted reviewing on behalf of kuiwang02 March 30, 2026 06:28 View session

CopilotAI reviewed Mar 30, 2026
View reviewed changes

Comment threadinternal/operator-controller/authorization/rbac.go
Comment threadcmd/operator-controller/main.go
Comment threadinternal/operator-controller/authorization/rbac.go Outdated

kuiwang02 changed the title ~~🐛 add create verb to boxcutter preflight~~🐛 make create verb a fixed namespaced collection verb for preflight checksMar 30, 2026

kuiwang02 force-pushed the fix78211 branch from a949d7e to 3860ac5Compare March 30, 2026 06:45

perdasilva reviewed Mar 30, 2026
View reviewed changes

add create verb to boxcutter preflight
42bc39a

CopilotAI review requested due to automatic review settings March 30, 2026 08:44

kuiwang02 force-pushed the fix78211 branch from 3860ac5 to 42bc39aCompare March 30, 2026 08:44

Copilotstarted reviewing on behalf of kuiwang02 March 30, 2026 08:44 View session

CopilotAI reviewed Mar 30, 2026
View reviewed changes

pedjak approved these changes Mar 30, 2026
View reviewed changes

openshift-ciBot added the lgtm Indicates that a PR is ready to be merged. label Mar 30, 2026

rashmigottipati approved these changes Mar 30, 2026
View reviewed changes

openshift-ciBot assigned rashmigottipati Mar 30, 2026

openshift-merge-botBot merged commit 7145047 into operator-framework:mainMar 30, 2026
34 of 36 checks passed

kuiwang02 deleted the fix78211 branch March 31, 2026 00:16

openshift-ci-robot mentioned this pull request Mar 31, 2026
OCPBUGS-76381,OCPBUGS-76383,OCPBUGS-78211,OCPBUGS-78455: Synchronize From Upstream Repositories openshift/operator-framework-operator-controller#682
Merged

Uh oh!

Conversation

kuiwang02 commented Mar 24, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Approach Change (Per @perdasilva's Suggestion)

Related Issues

Uh oh!

netlifyBot commented Mar 24, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for olmv1 ready!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

kuiwang02 commented Mar 24, 2026

Uh oh!

codecovBot commented Mar 24, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

fgiudici left a comment

Choose a reason for hiding this comment

Uh oh!

pedjak left a comment

Choose a reason for hiding this comment

Uh oh!

kuiwang02 commented Mar 25, 2026

Uh oh!

kuiwang02 commented Mar 25, 2026

Uh oh!

tmshort commented Mar 25, 2026

Uh oh!

kuiwang02 commented Mar 25, 2026

Uh oh!

jianzhangbjz commented Mar 27, 2026

Uh oh!

tmshort commented Mar 27, 2026

Uh oh!

pedjakMar 27, 2026

Choose a reason for hiding this comment

Uh oh!

kuiwang02Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

tmshort commented Mar 27, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kuiwang02 commented Mar 30, 2026

Uh oh!

perdasilvaMar 30, 2026

Choose a reason for hiding this comment

Uh oh!

kuiwang02Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

kuiwang02 commented Mar 30, 2026

Uh oh!

perdasilva commented Mar 30, 2026

Uh oh!

kuiwang02 commented Mar 30, 2026

Uh oh!

openshift-ciBot commented Mar 30, 2026

kuiwang02 commented Mar 24, 2026•
edited
Loading

netlifyBot commented Mar 24, 2026•
edited
Loading

codecovBot commented Mar 24, 2026•
edited
Loading