[geekhubuser]

Description

With the kube-apiserver admission plugin OwnerReferencesPermissionEnforcement (on by default on OpenShift), 2.36.0 cannot create the CDStageDeploy of an Auto Environment:

cdstagedeployments.v2.edp.epam.com "auto-app-devknvz7" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on

The CDStageDeploy carries a controller reference to its Stage (put_cd_stage_deploy.go:242), and the plugin then requires update on stages/finalizers. EPMDEDP-17305 rebuilt the Role from the markers, and no marker declared this permission, because no API call needs it. 2.35.0 had it through the hand-written Role.

This change adds the marker at the CodebaseImageStream controller, regenerates config/rbac/role.yaml, and mirrors the rule into the chart Role. The GitServer controller now also declares the delete on secrets it needs when it changes the owner references of its credential Secret. Today that grant comes only from the Codebase controller's marker.

Because the call-site rule cannot see grants that only the admission plugin consumes, a guard test checks them. controllers/rbac_test.go starts envtest with the plugin and binds config/rbac/role.yaml and the chart Role, each in a namespace of its own, to a non-admin user. It then writes every owner reference the controllers set, and includes a negative row. CLAUDE.md gets the matching convention line.

Fixes EPMDEDP-17422 (codebase-operator part; the cd-pipeline-operator part is a separate PR)

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Enhancement (non-breaking change which improves an existing feature or documentation)
• Breaking change (fix or feature that would cause existing functionality not to work as expected)

How Has This Been Tested?

kind (Kubernetes 1.36.4) with OwnerReferencesPermissionEnforcement on, both operators from their EPMDEDP-17422 branches. For the codebase-operator image, the branch binary was put on the 2.36.0 image, because the Dockerfile's pinned Alpine packages no longer install. The fix itself is the Role.

Flow	2.36.0 Role	This branch
A new image tag on an Auto Environment	cdstagedeployments ... is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on, no CDStageDeploy	CDStageDeploy created, owner Stage/app-dev, blockOwnerDeletion: true

Unit checks in golang:1.26 (Go 1.26.9):

Check	Result
Guard test with the fix	14/14 rows pass (7 per Role), 3 runs
Guard test on the master Roles	only Stage controls a new CDStageDeploy fails, in both Roles, with the production error
stages/finalizers removed from one Role only	only that Role's Stage controls a new CDStageDeploy fails
Admission plugin off	the negative row fails in both Roles
make test	pass, 43 packages
make lint	0 issues
make manifests	only the stages/finalizers line in config/rbac/role.yaml; no drift

Checklist:

• I have performed a self-review of my code
• I have commented on my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Pull Request contains one commit. I squash my commits.

[epmd-edp]

Pipeline review-codebase-operator-master-cn8f5 — ✗ Failed

Status	Task	Duration
✓ Passed	github-set-pending-status	5s
✓ Passed	fetch-repository	17s
✓ Passed	init-values	7s
✓ Passed	get-cache	2m9s
✓ Passed	commit-validate	6s
✓ Passed	dockerfile-lint	8s
✓ Passed	helm-lint	5s
✓ Passed	helm-docs	15s
✓ Passed	build	52s
✓ Passed	sonar	27s
✓ Passed	save-cache	2m17s
✗ Failed	buildkit-build	12s
✓ Passed	github-report-pipeline-status	7s

Pushing new commits re-runs this pipeline automatically.
To re-run it without new commits, comment /recheck.

✗ buildkit-build / build-and-push — exit code 1, last 100 log lines

2026/10/22 10:59:24 warning: unsuccessful cred copy: ".docker" from "/tekton/creds" to "/root": unable to open destination: open /root/.docker/config.json: read-only file system
time="2026-10-22T10:59:28Z" level=info msg="auto snapshotter: using overlayfs"
time="2026-10-22T10:59:28Z" level=info msg="found worker \"e38dche9ci84c1hrr8tn4kvrb\", labels=map[org.mobyproject.buildkit.worker.executor:oci org.mobyproject.buildkit.worker.hostname:review-codebase-operator-master-cn8f5-buildkit-build-pod org.mobyproject.buildkit.worker.network:host org.mobyproject.buildkit.worker.oci.process-mode:sandbox org.mobyproject.buildkit.worker.selinux.enabled:false org.mobyproject.buildkit.worker.snapshotter:overlayfs], platforms=[linux/amd64 linux/amd64/v2 linux/amd64/v3 linux/amd64/v4 linux/386]"
time="2026-10-22T10:59:28Z" level=warning msg="skipping containerd worker, as \"/run/containerd/containerd.sock\" does not exist"
time="2026-10-22T10:59:28Z" level=info msg="found 1 workers, default=\"e38dche9ci84c1hrr8tn4kvrb\""
time="2026-10-22T10:59:28Z" level=warning msg="currently, only the default worker can be used."
time="2026-10-22T10:59:28Z" level=info msg="running server on /run/buildkit/buildkitd.sock"
#1 [internal] load build definition from Dockerfile
#1 transferring dockerfile: 964B done
#1 DONE 0.0s

#2 [linux/amd64 internal] load metadata for docker.io/library/alpine:3.18.12
#2 ...

#3 [auth] library/alpine:pull token for registry-1.docker.io
#3 DONE 0.0s

#4 [linux/arm64 internal] load metadata for docker.io/library/alpine:3.18.12
#4 DONE 1.1s

#2 [linux/amd64 internal] load metadata for docker.io/library/alpine:3.18.12
#2 DONE 1.1s

#5 [internal] load .dockerignore
#5 transferring context: 2B done
#5 DONE 0.0s

#6 [internal] load build context
#6 ...

#7 [linux/arm64 1/8] FROM docker.io/library/alpine:3.18.12@sha256:de0eb0b3f2a47ba1eb89389859a9bd88b28e82f5826b6969ad604979713c2d4f
#7 resolve docker.io/library/alpine:3.18.12@sha256:de0eb0b3f2a47ba1eb89389859a9bd88b28e82f5826b6969ad604979713c2d4f 0.0s done
#7 sha256:95459497489f07b9d71d294c852a09f9bbf1af51bb35db752a31f6f48935e293 3.34MB / 3.34MB 0.1s done
#7 DONE 0.2s

#6 [internal] load build context
#6 ...

#8 [linux/amd64 1/8] FROM docker.io/library/alpine:3.18.12@sha256:de0eb0b3f2a47ba1eb89389859a9bd88b28e82f5826b6969ad604979713c2d4f
#8 resolve docker.io/library/alpine:3.18.12@sha256:de0eb0b3f2a47ba1eb89389859a9bd88b28e82f5826b6969ad604979713c2d4f 0.0s done
#8 sha256:44cf07d57ee4424189f012074a59110ee2065adfdde9c7d9826bebdffce0a885 3.42MB / 3.42MB 0.1s done
#8 extracting sha256:44cf07d57ee4424189f012074a59110ee2065adfdde9c7d9826bebdffce0a885 0.1s done
#8 DONE 0.3s

#7 [linux/arm64 1/8] FROM docker.io/library/alpine:3.18.12@sha256:de0eb0b3f2a47ba1eb89389859a9bd88b28e82f5826b6969ad604979713c2d4f
#7 extracting sha256:95459497489f07b9d71d294c852a09f9bbf1af51bb35db752a31f6f48935e293 0.1s done
#7 DONE 0.3s

#6 [internal] load build context
#6 transferring context: 113.88MB 0.9s done
#6 ...

#9 [internal] load build context
#9 transferring context: 107.23MB 0.9s done
#9 DONE 1.3s

#6 [internal] load build context
#6 DONE 1.3s

#10 [linux/amd64 2/8] RUN apk add --no-cache ca-certificates=20241121-r1                        openssh-client==9.3_p2-r3                         git==2.40.4-r0
#10 0.197 fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/main/x86_64/APKINDEX.tar.gz
#10 0.276 fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/community/x86_64/APKINDEX.tar.gz
#10 0.388 ERROR: unable to select packages:
#10 0.389   ca-certificates-20261020-r0:
#10 0.389     breaks: world[ca-certificates=20241121-r1]
#10 0.389     satisfies: libcurl-8.12.1-r0[ca-certificates]
#10 ERROR: process "/bin/sh -c apk add --no-cache ca-certificates=20241121-r1                        openssh-client==9.3_p2-r3                         git==2.40.4-r0" did not complete successfully: exit code: 3

#11 [linux/arm64 2/8] RUN apk add --no-cache ca-certificates=20241121-r1                        openssh-client==9.3_p2-r3                         git==2.40.4-r0
#11 0.247 fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/main/aarch64/APKINDEX.tar.gz
#11 0.661 fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/community/aarch64/APKINDEX.tar.gz
#11 1.193 (1/16) Installing ca-certificates (20241121-r1)
#11 1.215 (2/16) Installing brotli-libs (1.0.9-r14)
#11 1.248 (3/16) Installing libunistring (1.1-r1)
#11 1.291 (4/16) Installing libidn2 (2.3.4-r1)
#11 1.321 (5/16) Installing nghttp2-libs (1.57.0-r0)
#11 1.327 (6/16) Installing libpsl (0.21.5-r0)
#11 1.332 (7/16) Installing libcurl (8.12.1-r0)
#11 1.352 (8/16) Installing libexpat (2.7.0-r0)
#11 CANCELED
time="2026-10-22T10:59:32Z" level=error msg="/moby.buildkit.v1.Control/Solve returned error: rpc error: code = Unknown desc = process \"/bin/sh -c apk add --no-cache ca-certificates=20241121-r1                        openssh-client==9.3_p2-r3                         git==2.40.4-r0\" did not complete successfully: exit code: 3" spanID=602f8d221d652ad5 traceID=66593dd805d894539b788de5ff3db1a6
------
 > [linux/amd64 2/8] RUN apk add --no-cache ca-certificates=20241121-r1                        openssh-client==9.3_p2-r3                         git==2.40.4-r0:
0.197 fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/main/x86_64/APKINDEX.tar.gz
0.276 fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/community/x86_64/APKINDEX.tar.gz
0.388 ERROR: unable to select packages:
0.389   ca-certificates-20261020-r0:
0.389     breaks: world[ca-certificates=20241121-r1]
0.389     satisfies: libcurl-8.12.1-r0[ca-certificates]
------
Dockerfile:12
--------------------
  11 |     
  12 | >>> RUN apk add --no-cache ca-certificates=20241121-r1 \
  13 | >>>                        openssh-client==9.3_p2-r3  \
  14 | >>>                        git==2.40.4-r0
  15 |     
--------------------
error: failed to solve: process "/bin/sh -c apk add --no-cache ca-certificates=20241121-r1                        openssh-client==9.3_p2-r3                         git==2.40.4-r0" did not complete successfully: exit code: 3