[Fortune-Ndlovu]

Description of the change

Cherry-pick of #568 onto release-2.1.

Namespace inspect always reads the OVN, DeploymentConfig, Build, and ImageStream resources. The must-gather Role and ClusterRole did not allow those reads, so the gather returned Forbidden on clusters where the APIs exist. This change adds unconditional get and list permissions for those API groups in both RBAC templates.

On this branch the must-gather chart is 0.7.0, so the chart version is bumped to 0.7.1.

Which issue(s) does this PR fix or relate to

• https://redhat.atlassian.net/browse/RHDHBUGS-3768

How to test changes / Special notes to the reviewer

helm lint charts/must-gather

helm template test charts/must-gather | rg "k8s.ovn.org|apps.openshift.io|build.openshift.io|image.openshift.io"

helm template test charts/must-gather --set rbac.scope=namespace | rg "kind: Role|k8s.ovn.org|deploymentconfigs|buildconfigs|imagestreams"

helm template test charts/must-gather --set rbac.rules.monitoring=false | rg "servicemonitors|k8s.ovn.org"

helm lint should pass. The first template command should list the four new API groups on the ClusterRole. The namespace-scoped command should show the same resources on the Role. With monitoring disabled, k8s.ovn.org should still appear and servicemonitors should not.

Checklist

• For each Chart updated, version bumped in the corresponding Chart.yaml according to Semantic Versioning.
• For each Chart updated, variables are documented in the values.yaml and added to the corresponding README.md. The pre-commit utility can be used to generate the necessary content. Run pre-commit run --all-files to run the hooks and then push any resulting changes. The pre-commit Workflow will enforce this and warn you if needed.
• JSON Schema template updated and re-generated the raw schema via the pre-commit hook.
• Tests pass using the Chart Testing tool and the ct lint command.
• If you updated the orchestrator-infra chart, make sure the versions of the Knative CRDs are aligned with the versions of the CRDs installed by the OpenShift Serverless operators declared in the values.yaml file. See Installing Knative Eventing and Knative Serving CRDs for more details.

Made with Cursor

[rhdh-qodo-merge]

PR Summary by Qodo

Fix must-gather permissions for OpenShift namespace inspection

🐞 Bug fix 📝 Documentation ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Grant both must-gather RBAC scopes read access to OpenShift resources required by namespace
 inspection.
• Prevent Forbidden errors when those APIs are available, and release the fix as chart version
 0.7.1.

Diagram

graph TD
  V["Chart values"] --> S{"RBAC scope"} --> C["ClusterRole rules"] --> A["ServiceAccount"] --> G["Gather container"] --> O["OpenShift APIs"]
  S --> R["Namespace Role"] --> A

Loading

High-Level Assessment

Granting get and list on the required resources in both roles directly addresses the Forbidden errors without changing the gather workflow. Conditional RBAC flags were considered, but these reads are part of normal namespace inspection, so making the permissions optional would leave the default workflow vulnerable to the same failure.

Files changed (4) +27 / -3

Bug fix (2) +24 / -0

clusterrbac.yamlAllow cluster-scoped reads of required OpenShift resources +12/-0

Allow cluster-scoped reads of required OpenShift resources

• Adds unconditional get and list rules for OVN egress and user-defined network resources, DeploymentConfigs, BuildConfigs, Builds, and ImageStreams to the ClusterRole.

charts/must-gather/templates/clusterrbac.yaml

rbac.yamlAllow namespace-scoped reads of required OpenShift resources +12/-0

Allow namespace-scoped reads of required OpenShift resources

• Adds the same unconditional OpenShift API read rules to the namespace-scoped Role so namespace inspection can access those resources.

charts/must-gather/templates/rbac.yaml

Documentation (1) +2 / -2

README.mdDocument chart version 0.7.1 +2/-2

Document chart version 0.7.1

• Updates the version badge and Helm installation example to reference 0.7.1.

charts/must-gather/README.md

Other (1) +1 / -1

Chart.yamlBump must-gather chart to 0.7.1 +1/-1

Bump must-gather chart to 0.7.1

• Increments the chart patch version from 0.7.0 to 0.7.1 for the RBAC fix.

charts/must-gather/Chart.yaml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (1) 📜 Skill insights (0)

1. Restricted chart installs fail 🔗 Cross-repo conflict ≡ Correctness

Description

The new OpenShift and OVN rules are unconditional in both RBAC templates, with no chart values to
omit permissions an installer cannot grant. When rhdh-must-gather installs the published chart
through hack/deploy-k8s.sh, or when the chart is upgraded, an installer lacking authority to grant
any of those rules can fail Kubernetes RBAC escalation checks despite the chart documenting how to
disable ungrantable rules.

Code

charts/must-gather/templates/rbac.yaml[R41-43]

+  - apiGroups: ["k8s.ovn.org"]
+    resources: ["egressfirewalls", "egressqoses", "userdefinednetworks"]
+    verbs: ["get", "list"]

Relevance

●● Moderate

Concrete RBAC escalation risk, but conditional-permission precedent is indirect and conflicts with
this PR’s intentional unconditional inspection grants.

PR-#326
PR-#523

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Both RBAC templates add the OpenShift and OVN grants without conditions. The chart instructs
installers to disable individual rules they cannot grant, but its existing switches and schema have
no entries for the added groups; the other repository's deployment script invokes Helm to install
the chart.

rhdh-chart -> rhdh-must-gather
charts/must-gather/templates/rbac.yaml[41-52]
charts/must-gather/templates/clusterrbac.yaml[48-59]
charts/must-gather/values.yaml[39-66]
charts/must-gather/values.yaml[29-54]
charts/must-gather/values.schema.json[1332-1391]
External repo: redhat-developer/rhdh-must-gather, hack/deploy-k8s.sh [324-328]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new OpenShift and OVN rules cannot be disabled by installers who lack authority to grant them, potentially preventing chart installation or upgrade, including installation by `rhdh-must-gather`.

## Fix Focus Areas
- charts/must-gather/templates/rbac.yaml[41-52]
- charts/must-gather/templates/clusterrbac.yaml[48-59]
- charts/must-gather/values.yaml[29-66]
- charts/must-gather/values.schema.tmpl.json[108-158]
- /cross_repos/rhdh-must-gather/hack/deploy-k8s.sh[324-328]

## Recommended Fix
Add documented, default-enabled values switches for the new API-group rules and guard the corresponding blocks in both RBAC templates. Regenerate the values schema and README so restricted installers can disable only the permissions they cannot grant.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

---

Context sources

⚠️ Tickets: not configured — ticket URL found in PR but could not be fetched — check ticket provider credentials

✅ Cross-repo context — repo relationships

  Explored: repo: redhat-developer/rhdh-must-gather (sha: 4e4ce2fe) — View relationship

Review mode: ⚖️ Balanced: This is a localized RBAC behavior change affecting cluster and namespace permissions, so it warrants a careful review despite the small diff.

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[rhdh-qodo-merge]

Important

The /generate_labels command by Qodo is sunsetting on the 1st of October 2026 and will no longer be available. We recommend switching to the latest Qodo review capabilities. Learn more