Skip to content

[occm] Fix cloud-node-controller ClusterRoleBinding subject#3092

Open
fakman0 wants to merge 1 commit intokubernetes:masterfrom
fakman0:fix/occm-node-controller-rbac-binding
Open

[occm] Fix cloud-node-controller ClusterRoleBinding subject#3092
fakman0 wants to merge 1 commit intokubernetes:masterfrom
fakman0:fix/occm-node-controller-rbac-binding

Conversation

@fakman0
Copy link
Copy Markdown
Contributor

@fakman0 fakman0 commented Apr 2, 2026

Summary

  • The system:cloud-node-controller ClusterRoleBinding in raw manifests was bound to a non-existent cloud-node-controller ServiceAccount
  • The DaemonSet uses serviceAccountName: cloud-controller-manager, and no cloud-node-controller SA is defined anywhere in the repo
  • Fixed the binding subject to cloud-controller-manager to match the actual deployment model
  • This aligns the raw manifests with the Helm chart, which already binds both roles to cloud-controller-manager

Test plan

  • Deployed raw manifests to a live cluster and verified all 3 OCCM pods are Running/Ready
  • Verified both ClusterRoleBindings point to cloud-controller-manager SA
  • Confirmed SA has correct RBAC permissions via kubectl auth can-i
Fix cloud-node-controller ClusterRoleBinding to reference the correct cloud-controller-manager ServiceAccount

The system:cloud-node-controller ClusterRoleBinding was bound to a
non-existent cloud-node-controller ServiceAccount. The DaemonSet uses
cloud-controller-manager, so fix the binding subject to match.
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 2, 2026
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

Hi @fakman0. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot
Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign stephenfin for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot requested review from dulek and kayrus April 2, 2026 15:37
@k8s-ci-robot k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 2, 2026
@fakman0 fakman0 marked this pull request as ready for review April 2, 2026 15:39
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 2, 2026
@k8s-ci-robot k8s-ci-robot requested a review from stephenfin April 2, 2026 15:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants