From 1aa5a83070666e640e025dda0e901df936705fbb Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Thu, 25 Jun 2026 08:59:14 +0300 Subject: [PATCH 1/4] helm: add release name prefixes to clusterroles Signed-off-by: Tuomas Katila --- charts/gpu-base-operator/templates/metrics_auth_role.yaml | 2 +- .../templates/metrics_auth_role_binding.yaml | 4 ++-- charts/gpu-base-operator/templates/role.yaml | 2 +- charts/gpu-base-operator/templates/role_binding.yaml | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/charts/gpu-base-operator/templates/metrics_auth_role.yaml b/charts/gpu-base-operator/templates/metrics_auth_role.yaml index 32d2e4e..1e84a11 100644 --- a/charts/gpu-base-operator/templates/metrics_auth_role.yaml +++ b/charts/gpu-base-operator/templates/metrics_auth_role.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: metrics-auth-role + name: {{ .Release.Name }}-metrics-auth-role rules: - apiGroups: - authentication.k8s.io diff --git a/charts/gpu-base-operator/templates/metrics_auth_role_binding.yaml b/charts/gpu-base-operator/templates/metrics_auth_role_binding.yaml index f480bb3..0b798dd 100644 --- a/charts/gpu-base-operator/templates/metrics_auth_role_binding.yaml +++ b/charts/gpu-base-operator/templates/metrics_auth_role_binding.yaml @@ -1,11 +1,11 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: metrics-auth-rolebinding + name: {{ .Release.Name }}-metrics-auth-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: metrics-auth-role + name: {{ .Release.Name }}-metrics-auth-role subjects: - kind: ServiceAccount name: controller-manager diff --git a/charts/gpu-base-operator/templates/role.yaml b/charts/gpu-base-operator/templates/role.yaml index e691942..c556fbd 100644 --- a/charts/gpu-base-operator/templates/role.yaml +++ b/charts/gpu-base-operator/templates/role.yaml @@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: manager-role + name: {{ .Release.Name }}-manager-role rules: - apiGroups: - "" diff --git a/charts/gpu-base-operator/templates/role_binding.yaml b/charts/gpu-base-operator/templates/role_binding.yaml index f6922fc..0255448 100644 --- a/charts/gpu-base-operator/templates/role_binding.yaml +++ b/charts/gpu-base-operator/templates/role_binding.yaml @@ -4,11 +4,11 @@ metadata: labels: app.kubernetes.io/name: intel-gpu-base-operator app.kubernetes.io/managed-by: kustomize - name: manager-rolebinding + name: {{ .Release.Name }}-manager-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: manager-role + name: {{ .Release.Name }}-manager-role subjects: - kind: ServiceAccount name: controller-manager From b07c482d854278d68ee96278e2272f8f343bebe2 Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Thu, 25 Jun 2026 10:06:29 +0300 Subject: [PATCH 2/4] helm: remove unnecessary clusterroles Signed-off-by: Tuomas Katila --- .../templates/clusterpolicy_admin_role.yaml | 27 --------------- .../templates/clusterpolicy_editor_role.yaml | 33 ------------------- .../templates/clusterpolicy_viewer_role.yaml | 29 ---------------- .../gpufirmwareupdate_admin_role.yaml | 27 --------------- .../gpufirmwareupdate_editor_role.yaml | 33 ------------------- .../gpufirmwareupdate_viewer_role.yaml | 29 ---------------- 6 files changed, 178 deletions(-) delete mode 100644 charts/gpu-base-operator/templates/clusterpolicy_admin_role.yaml delete mode 100644 charts/gpu-base-operator/templates/clusterpolicy_editor_role.yaml delete mode 100644 charts/gpu-base-operator/templates/clusterpolicy_viewer_role.yaml delete mode 100644 charts/gpu-base-operator/templates/gpufirmwareupdate_admin_role.yaml delete mode 100644 charts/gpu-base-operator/templates/gpufirmwareupdate_editor_role.yaml delete mode 100644 charts/gpu-base-operator/templates/gpufirmwareupdate_viewer_role.yaml diff --git a/charts/gpu-base-operator/templates/clusterpolicy_admin_role.yaml b/charts/gpu-base-operator/templates/clusterpolicy_admin_role.yaml deleted file mode 100644 index 032aa84..0000000 --- a/charts/gpu-base-operator/templates/clusterpolicy_admin_role.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# This rule is not used by the project intel-gpu-base-operator itself. -# It is provided to allow the cluster admin to help manage permissions for users. -# -# Grants full permissions ('*') over intel.com. -# This role is intended for users authorized to modify roles and bindings within the cluster, -# enabling them to delegate specific permissions to other users or groups as needed. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: intel-gpu-base-operator - app.kubernetes.io/managed-by: kustomize - name: clusterpolicy-admin-role -rules: -- apiGroups: - - intel.com - resources: - - clusterpolicies - verbs: - - '*' -- apiGroups: - - intel.com - resources: - - clusterpolicies/status - verbs: - - get diff --git a/charts/gpu-base-operator/templates/clusterpolicy_editor_role.yaml b/charts/gpu-base-operator/templates/clusterpolicy_editor_role.yaml deleted file mode 100644 index c935802..0000000 --- a/charts/gpu-base-operator/templates/clusterpolicy_editor_role.yaml +++ /dev/null @@ -1,33 +0,0 @@ -# This rule is not used by the project intel-gpu-base-operator itself. -# It is provided to allow the cluster admin to help manage permissions for users. -# -# Grants permissions to create, update, and delete resources within the intel.com. -# This role is intended for users who need to manage these resources -# but should not control RBAC or manage permissions for others. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: intel-gpu-base-operator - app.kubernetes.io/managed-by: kustomize - name: clusterpolicy-editor-role -rules: -- apiGroups: - - intel.com - resources: - - clusterpolicies - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - intel.com - resources: - - clusterpolicies/status - verbs: - - get diff --git a/charts/gpu-base-operator/templates/clusterpolicy_viewer_role.yaml b/charts/gpu-base-operator/templates/clusterpolicy_viewer_role.yaml deleted file mode 100644 index af3839b..0000000 --- a/charts/gpu-base-operator/templates/clusterpolicy_viewer_role.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# This rule is not used by the project intel-gpu-base-operator itself. -# It is provided to allow the cluster admin to help manage permissions for users. -# -# Grants read-only access to intel.com resources. -# This role is intended for users who need visibility into these resources -# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: intel-gpu-base-operator - app.kubernetes.io/managed-by: kustomize - name: clusterpolicy-viewer-role -rules: -- apiGroups: - - intel.com - resources: - - clusterpolicies - verbs: - - get - - list - - watch -- apiGroups: - - intel.com - resources: - - clusterpolicies/status - verbs: - - get diff --git a/charts/gpu-base-operator/templates/gpufirmwareupdate_admin_role.yaml b/charts/gpu-base-operator/templates/gpufirmwareupdate_admin_role.yaml deleted file mode 100644 index 55289a2..0000000 --- a/charts/gpu-base-operator/templates/gpufirmwareupdate_admin_role.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# This rule is not used by the project intel-gpu-base-operator itself. -# It is provided to allow the cluster admin to help manage permissions for users. -# -# Grants full permissions ('*') over intel.com. -# This role is intended for users authorized to modify roles and bindings within the cluster, -# enabling them to delegate specific permissions to other users or groups as needed. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: intel-gpu-base-operator - app.kubernetes.io/managed-by: kustomize - name: gpufirmwareupdate-admin-role -rules: -- apiGroups: - - intel.com - resources: - - gpufirmwareupdates - verbs: - - '*' -- apiGroups: - - intel.com - resources: - - gpufirmwareupdates/status - verbs: - - get diff --git a/charts/gpu-base-operator/templates/gpufirmwareupdate_editor_role.yaml b/charts/gpu-base-operator/templates/gpufirmwareupdate_editor_role.yaml deleted file mode 100644 index 8215e26..0000000 --- a/charts/gpu-base-operator/templates/gpufirmwareupdate_editor_role.yaml +++ /dev/null @@ -1,33 +0,0 @@ -# This rule is not used by the project intel-gpu-base-operator itself. -# It is provided to allow the cluster admin to help manage permissions for users. -# -# Grants permissions to create, update, and delete resources within the intel.com. -# This role is intended for users who need to manage these resources -# but should not control RBAC or manage permissions for others. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: intel-gpu-base-operator - app.kubernetes.io/managed-by: kustomize - name: gpufirmwareupdate-editor-role -rules: -- apiGroups: - - intel.com - resources: - - gpufirmwareupdates - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - intel.com - resources: - - gpufirmwareupdates/status - verbs: - - get diff --git a/charts/gpu-base-operator/templates/gpufirmwareupdate_viewer_role.yaml b/charts/gpu-base-operator/templates/gpufirmwareupdate_viewer_role.yaml deleted file mode 100644 index 57e968f..0000000 --- a/charts/gpu-base-operator/templates/gpufirmwareupdate_viewer_role.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# This rule is not used by the project intel-gpu-base-operator itself. -# It is provided to allow the cluster admin to help manage permissions for users. -# -# Grants read-only access to intel.com resources. -# This role is intended for users who need visibility into these resources -# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: intel-gpu-base-operator - app.kubernetes.io/managed-by: kustomize - name: gpufirmwareupdate-viewer-role -rules: -- apiGroups: - - intel.com - resources: - - gpufirmwareupdates - verbs: - - get - - list - - watch -- apiGroups: - - intel.com - resources: - - gpufirmwareupdates/status - verbs: - - get From f7f28fd2508996bdcd08e904f3dba670e6e074a6 Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Thu, 25 Jun 2026 11:00:38 +0300 Subject: [PATCH 3/4] helm: prefix controller-manager with release name In case the operator is installed into same namespace with other operator-sdk generated operators. Signed-off-by: Tuomas Katila --- .../templates/leader_election_role_binding.yaml | 2 +- charts/gpu-base-operator/templates/manager.yaml | 10 +++++----- .../templates/metrics_auth_role_binding.yaml | 2 +- .../templates/namespaced_role_binding.yaml | 2 +- charts/gpu-base-operator/templates/role_binding.yaml | 2 +- .../gpu-base-operator/templates/service_account.yaml | 2 +- .../gpu-base-operator/templates/webhook_service.yaml | 2 +- 7 files changed, 11 insertions(+), 11 deletions(-) diff --git a/charts/gpu-base-operator/templates/leader_election_role_binding.yaml b/charts/gpu-base-operator/templates/leader_election_role_binding.yaml index 85e9845..64eda85 100644 --- a/charts/gpu-base-operator/templates/leader_election_role_binding.yaml +++ b/charts/gpu-base-operator/templates/leader_election_role_binding.yaml @@ -11,5 +11,5 @@ roleRef: name: leader-election-role subjects: - kind: ServiceAccount - name: controller-manager + name: {{ .Release.Name }}-controller-manager namespace: {{ .Release.Namespace }} diff --git a/charts/gpu-base-operator/templates/manager.yaml b/charts/gpu-base-operator/templates/manager.yaml index 2c2b274..bec40f0 100644 --- a/charts/gpu-base-operator/templates/manager.yaml +++ b/charts/gpu-base-operator/templates/manager.yaml @@ -1,15 +1,15 @@ apiVersion: apps/v1 kind: Deployment metadata: - name: controller-manager + name: {{ .Release.Name }}-controller-manager labels: - control-plane: controller-manager + control-plane: {{ .Release.Name }}-controller-manager app.kubernetes.io/name: intel-gpu-base-operator app.kubernetes.io/managed-by: kustomize spec: selector: matchLabels: - control-plane: controller-manager + control-plane: {{ .Release.Name }}-controller-manager app.kubernetes.io/name: intel-gpu-base-operator replicas: 1 template: @@ -17,7 +17,7 @@ spec: annotations: kubectl.kubernetes.io/default-container: manager labels: - control-plane: controller-manager + control-plane: {{ .Release.Name }}-controller-manager app.kubernetes.io/name: intel-gpu-base-operator spec: # TODO(user): Uncomment the following code to configure the nodeAffinity expression @@ -105,7 +105,7 @@ spec: requests: cpu: {{ .Values.operator.resources.requests.cpu | default "10m" }} memory: {{ .Values.operator.resources.requests.memory | default "64Mi" }} - serviceAccountName: controller-manager + serviceAccountName: {{ .Release.Name }}-controller-manager terminationGracePeriodSeconds: 10 volumes: - name: webhook-certs diff --git a/charts/gpu-base-operator/templates/metrics_auth_role_binding.yaml b/charts/gpu-base-operator/templates/metrics_auth_role_binding.yaml index 0b798dd..63db601 100644 --- a/charts/gpu-base-operator/templates/metrics_auth_role_binding.yaml +++ b/charts/gpu-base-operator/templates/metrics_auth_role_binding.yaml @@ -8,5 +8,5 @@ roleRef: name: {{ .Release.Name }}-metrics-auth-role subjects: - kind: ServiceAccount - name: controller-manager + name: {{ .Release.Name }}-controller-manager namespace: {{ .Release.Namespace }} diff --git a/charts/gpu-base-operator/templates/namespaced_role_binding.yaml b/charts/gpu-base-operator/templates/namespaced_role_binding.yaml index 064af69..ad05029 100644 --- a/charts/gpu-base-operator/templates/namespaced_role_binding.yaml +++ b/charts/gpu-base-operator/templates/namespaced_role_binding.yaml @@ -12,5 +12,5 @@ roleRef: name: manager-namespaced-role subjects: - kind: ServiceAccount - name: controller-manager + name: {{ .Release.Name }}-controller-manager namespace: {{ .Release.Namespace }} diff --git a/charts/gpu-base-operator/templates/role_binding.yaml b/charts/gpu-base-operator/templates/role_binding.yaml index 0255448..bedd155 100644 --- a/charts/gpu-base-operator/templates/role_binding.yaml +++ b/charts/gpu-base-operator/templates/role_binding.yaml @@ -11,5 +11,5 @@ roleRef: name: {{ .Release.Name }}-manager-role subjects: - kind: ServiceAccount - name: controller-manager + name: {{ .Release.Name }}-controller-manager namespace: {{.Release.Namespace }} diff --git a/charts/gpu-base-operator/templates/service_account.yaml b/charts/gpu-base-operator/templates/service_account.yaml index 53a1ce4..eace817 100644 --- a/charts/gpu-base-operator/templates/service_account.yaml +++ b/charts/gpu-base-operator/templates/service_account.yaml @@ -4,5 +4,5 @@ metadata: labels: app.kubernetes.io/name: intel-gpu-base-operator app.kubernetes.io/managed-by: kustomize - name: controller-manager + name: {{ .Release.Name }}-controller-manager namespace: {{ .Release.Namespace }} diff --git a/charts/gpu-base-operator/templates/webhook_service.yaml b/charts/gpu-base-operator/templates/webhook_service.yaml index c1e8038..d93a524 100644 --- a/charts/gpu-base-operator/templates/webhook_service.yaml +++ b/charts/gpu-base-operator/templates/webhook_service.yaml @@ -14,4 +14,4 @@ spec: targetPort: 9443 selector: app.kubernetes.io/name: intel-gpu-base-operator - control-plane: controller-manager + control-plane: {{ .Release.Name }}-controller-manager From 17bb48d0c1b6499307826b21caf7953ac6422323 Mon Sep 17 00:00:00 2001 From: Tuomas Katila Date: Thu, 25 Jun 2026 11:26:55 +0300 Subject: [PATCH 4/4] make: drop role sync with helm as they cannot be same anymore Signed-off-by: Tuomas Katila --- Makefile | 1 - 1 file changed, 1 deletion(-) diff --git a/Makefile b/Makefile index 0f21bd7..5e1ac01 100644 --- a/Makefile +++ b/Makefile @@ -403,7 +403,6 @@ endif crdsync: generate manifests cp config/crd/bases/intel.com_clusterpolicies.yaml charts/gpu-base-operator/crds/clusterpolicies.yaml cp config/crd/bases/intel.com_gpufirmwareupdates.yaml charts/gpu-base-operator/crds/gpufirmwareupdates.yaml - cp config/rbac/role.yaml charts/gpu-base-operator/templates/role.yaml .PHONY: check-generated-files check-generated-files: crdsync