From d5217752fc602d49a46d5f7032dd77112ca18179 Mon Sep 17 00:00:00 2001 From: Fortune Ndlovu Date: Tue, 29 Sep 2026 17:15:08 +0100 Subject: [PATCH] fix(must-gather): grant inspect RBAC for OpenShift API groups (#568) Namespace inspect always reads OVN, DeploymentConfig, Build, and ImageStream resources. The chart Role and ClusterRole did not allow those reads, so gather returned Forbidden on clusters where the APIs exist. RHDHBUGS-3768 Signed-off-by: Fortune-Ndlovu --- charts/must-gather/Chart.yaml | 2 +- charts/must-gather/README.md | 4 ++-- charts/must-gather/templates/clusterrbac.yaml | 12 ++++++++++++ charts/must-gather/templates/rbac.yaml | 12 ++++++++++++ 4 files changed, 27 insertions(+), 3 deletions(-) diff --git a/charts/must-gather/Chart.yaml b/charts/must-gather/Chart.yaml index 909dc8cbb..85dd6dc77 100644 --- a/charts/must-gather/Chart.yaml +++ b/charts/must-gather/Chart.yaml @@ -35,4 +35,4 @@ maintainers: # Versions are expected to follow Semantic Versioning (https://semver.org/) # Note that when this chart is published to https://github.com/openshift-helm-charts/charts # it will follow the RHDH versioning 1.y.z -version: 0.7.0 +version: 0.7.1 diff --git a/charts/must-gather/README.md b/charts/must-gather/README.md index 891f29954..1702115af 100644 --- a/charts/must-gather/README.md +++ b/charts/must-gather/README.md @@ -1,7 +1,7 @@ # Must Gather Chart for Red Hat Developer Hub (RHDH) -![Version: 0.7.0](https://img.shields.io/badge/Version-0.7.0-informational?style=flat-square) +![Version: 0.7.1](https://img.shields.io/badge/Version-0.7.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) A Helm chart for running the RHDH Must-Gather diagnostic tool on Kubernetes @@ -27,7 +27,7 @@ Kubernetes: `>= 1.27.0-0` ```console helm upgrade --install my-rhdh-must-gather redhat-developer-hub-must-gather \ --repo https://redhat-developer.github.io/rhdh-chart \ - --version 0.7.0 \ + --version 0.7.1 \ [--wait --timeout=$duration] ``` diff --git a/charts/must-gather/templates/clusterrbac.yaml b/charts/must-gather/templates/clusterrbac.yaml index ebb7a9af5..f206a593f 100644 --- a/charts/must-gather/templates/clusterrbac.yaml +++ b/charts/must-gather/templates/clusterrbac.yaml @@ -45,6 +45,18 @@ rules: - apiGroups: ["batch"] resources: ["jobs", "cronjobs"] verbs: ["get", "list"] + - apiGroups: ["k8s.ovn.org"] + resources: ["egressfirewalls", "egressqoses", "userdefinednetworks"] + verbs: ["get", "list"] + - apiGroups: ["apps.openshift.io"] + resources: ["deploymentconfigs"] + verbs: ["get", "list"] + - apiGroups: ["build.openshift.io"] + resources: ["buildconfigs", "builds"] + verbs: ["get", "list"] + - apiGroups: ["image.openshift.io"] + resources: ["imagestreams"] + verbs: ["get", "list"] {{- if .Values.rbac.rules.routes }} - apiGroups: ["route.openshift.io"] resources: ["routes"] diff --git a/charts/must-gather/templates/rbac.yaml b/charts/must-gather/templates/rbac.yaml index 4348ec375..739b452e7 100644 --- a/charts/must-gather/templates/rbac.yaml +++ b/charts/must-gather/templates/rbac.yaml @@ -38,6 +38,18 @@ rules: - apiGroups: ["batch"] resources: ["jobs", "cronjobs"] verbs: ["get", "list"] + - apiGroups: ["k8s.ovn.org"] + resources: ["egressfirewalls", "egressqoses", "userdefinednetworks"] + verbs: ["get", "list"] + - apiGroups: ["apps.openshift.io"] + resources: ["deploymentconfigs"] + verbs: ["get", "list"] + - apiGroups: ["build.openshift.io"] + resources: ["buildconfigs", "builds"] + verbs: ["get", "list"] + - apiGroups: ["image.openshift.io"] + resources: ["imagestreams"] + verbs: ["get", "list"] {{- if .Values.rbac.rules.routes }} - apiGroups: ["route.openshift.io"] resources: ["routes"]