[geekhubuser]

Description

With the kube-apiserver admission plugin OwnerReferencesPermissionEnforcement (on by default on OpenShift), 2.36.0 cannot create the CDStageDeploy of an Auto Environment:

cdstagedeployments.v2.edp.epam.com "auto-app-devknvz7" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on

The CDStageDeploy carries a controller reference to its Stage (put_cd_stage_deploy.go:242), and the plugin then requires update on stages/finalizers. EPMDEDP-17305 rebuilt the Role from the markers, and no marker declared this permission, because no API call needs it. 2.35.0 had it through the hand-written Role.

This change adds the marker at the CodebaseImageStream controller, regenerates config/rbac/role.yaml, and mirrors the rule into the chart Role. The GitServer controller now also declares the delete on secrets it needs when it changes the owner references of its credential Secret. Today that grant comes only from the Codebase controller's marker.

Because the call-site rule cannot see grants that only the admission plugin consumes, a guard test checks them. controllers/rbac_test.go starts envtest with the plugin and binds config/rbac/role.yaml and the chart Role, each in a namespace of its own, to a non-admin user. It then writes every owner reference the controllers set, and includes a negative row. CLAUDE.md gets the matching convention line.

Fixes EPMDEDP-17422 (codebase-operator part; the cd-pipeline-operator part is a separate PR)

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Enhancement (non-breaking change which improves an existing feature or documentation)
• Breaking change (fix or feature that would cause existing functionality not to work as expected)

How Has This Been Tested?

kind (Kubernetes 1.36.4) with OwnerReferencesPermissionEnforcement on, both operators from their EPMDEDP-17422 branches. For the codebase-operator image, the branch binary was put on the 2.36.0 image, because the Dockerfile's pinned Alpine packages no longer install. The fix itself is the Role.

Flow	2.36.0 Role	This branch
A new image tag on an Auto Environment	cdstagedeployments ... is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on, no CDStageDeploy	CDStageDeploy created, owner Stage/app-dev, blockOwnerDeletion: true

Unit checks in golang:1.26 (Go 1.26.9):

Check	Result
Guard test with the fix	14/14 rows pass (7 per Role), 3 runs
Guard test on the master Roles	only Stage controls a new CDStageDeploy fails, in both Roles, with the production error
stages/finalizers removed from one Role only	only that Role's Stage controls a new CDStageDeploy fails
Admission plugin off	the negative row fails in both Roles
make test	pass, 43 packages
make lint	0 issues
make manifests	only the stages/finalizers line in config/rbac/role.yaml; no drift

Checklist:

• I have performed a self-review of my code
• I have commented on my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Pull Request contains one commit. I squash my commits.

[epmd-edp]

Pipeline review-codebase-operator-master-rpgl9 — ✓ Passed

Status	Task	Duration
✓ Passed	github-set-pending-status	8s
✓ Passed	fetch-repository	11s
✓ Passed	init-values	6s
✓ Passed	get-cache	1m55s
✓ Passed	commit-validate	6s
✓ Passed	dockerfile-lint	8s
✓ Passed	helm-lint	7s
✓ Passed	helm-docs	13s
✓ Passed	build	50s
✓ Passed	sonar	21s
✓ Passed	save-cache	7s
✓ Passed	buildkit-build	28s
✓ Passed	github-report-pipeline-status	7s

Pushing new commits re-runs this pipeline automatically.
To re-run it without new commits, comment /recheck.

[geekhubuser]

Closing: there is no request for this yet, so there is no point in fixing it now. The missing grants matter only with the OwnerReferencesPermissionEnforcement admission plugin, which OpenShift enables by default. The branch stays, so this can be reopened when it is needed.