unkinben
e7760b79f4
The operator strict-decodes CR specs, so when the in-cluster CRDs lag the running operator (e.g. CRDs pinned to v0.1.0 while the operator ran v0.3.0), new spec fields fail to decode with no operator-side signal. This adds an advisory startup check so the mismatch is visible in the operator logs. - Add CheckCRDVersions: GET each owned CRD and verify it carries a version-sentinel spec field, logging a distinct WARNING per problem (missing CRD vs. present-but-stale schema); advisory only, never exits. - Keep the sentinel list (buckets/managePolicy, objectstoreusers/ retainOnDelete, bucketaccesses/rawStatements) in one place. - Wire the check into operator startup after the manager config is available. - Add apiextensions customresourcedefinitions get;list RBAC marker and regenerate config/rbac/role.yaml. - Promote k8s.io/apiextensions-apiserver to a direct dependency. Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM
58 lines
818 B
YAML
58 lines
818 B
YAML
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: cephrgw-operator
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- secrets
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- apiextensions.k8s.io
|
|
resources:
|
|
- customresourcedefinitions
|
|
verbs:
|
|
- get
|
|
- list
|
|
- apiGroups:
|
|
- ceph.unkin.net
|
|
resources:
|
|
- bucketaccesses
|
|
- buckets
|
|
- objectstoreusers
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- ceph.unkin.net
|
|
resources:
|
|
- bucketaccesses/finalizers
|
|
- buckets/finalizers
|
|
- objectstoreusers/finalizers
|
|
verbs:
|
|
- update
|
|
- apiGroups:
|
|
- ceph.unkin.net
|
|
resources:
|
|
- bucketaccesses/status
|
|
- buckets/status
|
|
- objectstoreusers/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|