From bb483c29905a54ebc6519c814636d8dad3449bc5 Mon Sep 17 00:00:00 2001
From: tejassinghbhati <tejassinghbhati077@gmail.com>
Date: Fri, 14 Aug 2026 20:01:55 +0530
Subject: [PATCH] feat: catch RBAC drift between config/rbac and chart via diff

The chart's manager ClusterRole was hand written, so nothing noticed when
it fell behind config/rbac/role.yaml. That is how #350 happened, where
the chart was missing the events.k8s.io group and every taint event was
refused on a Helm install.

The rules are now a verbatim copy of the generated block wrapped with
BEGIN/END sentinel comments, and hack/verify-chart-drift.sh pulls that
block back out of the template and diffs it, the same way it already
checks the bundled CRD.

Dropping events.k8s.io from the copy reproduces #350 and the check fails
with a diff pointing straight at the missing group.

Signed-off-by: tejassinghbhati <tejassinghbhati077@gmail.com>
---
 .../templates/rbac.yaml                       | 72 ++++++++++++++-----
 hack/verify-chart-drift.sh                    | 11 +++
 2 files changed, 65 insertions(+), 18 deletions(-)

diff --git a/charts/node-readiness-controller/templates/rbac.yaml b/charts/node-readiness-controller/templates/rbac.yaml
index 3152cde9..f69f70bf 100644
--- a/charts/node-readiness-controller/templates/rbac.yaml
+++ b/charts/node-readiness-controller/templates/rbac.yaml
@@ -36,25 +36,61 @@ metadata:
   name: {{ include "node-readiness-controller.fullname" . }}-manager-role
   labels:
     {{- include "node-readiness-controller.labels" . | nindent 4 }}
+# Copied verbatim from config/rbac/role.yaml (generated by controller-gen).
+# hack/verify-chart-drift.sh diffs the block between the BEGIN/END markers
+# against the generated file. Do not edit the rules by hand; run
+# `make manifests` and copy the output here.
+# BEGIN GENERATED RBAC RULES
 rules:
-  - apiGroups: ["", "events.k8s.io"]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list", "patch", "update", "watch"]
-  - apiGroups: [""]
-    resources: ["nodes/status"]
-    verbs: ["get"]
-  - apiGroups: ["readiness.node.x-k8s.io"]
-    resources: ["nodereadinessrules"]
-    verbs: ["get", "list", "patch", "update", "watch"]
-  - apiGroups: ["readiness.node.x-k8s.io"]
-    resources: ["nodereadinessrules/finalizers"]
-    verbs: ["update"]
-  - apiGroups: ["readiness.node.x-k8s.io"]
-    resources: ["nodereadinessrules/status"]
-    verbs: ["get", "patch", "update"]
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - nodes/status
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  - events.k8s.io
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+- apiGroups:
+  - readiness.node.x-k8s.io
+  resources:
+  - nodereadinessrules
+  verbs:
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - readiness.node.x-k8s.io
+  resources:
+  - nodereadinessrules/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - readiness.node.x-k8s.io
+  resources:
+  - nodereadinessrules/status
+  verbs:
+  - get
+  - patch
+  - update
+# END GENERATED RBAC RULES
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
diff --git a/hack/verify-chart-drift.sh b/hack/verify-chart-drift.sh
index d43c28c0..2886dc68 100755
--- a/hack/verify-chart-drift.sh
+++ b/hack/verify-chart-drift.sh
@@ -28,3 +28,14 @@ make manifests
 diff -u \
   config/crd/bases/readiness.node.x-k8s.io_nodereadinessrules.yaml \
   charts/node-readiness-controller/crds/nodereadinessrules.readiness.node.x-k8s.io.yaml
+
+# ---------- RBAC drift ----------
+# The chart's manager ClusterRole carries a verbatim copy of the rules from
+# config/rbac/role.yaml, wrapped in BEGIN/END sentinel comments.  Extract that
+# block and diff it against the generated file.
+echo "Verifying chart manager RBAC matches config/rbac/role.yaml..."
+diff -u \
+  <(sed 's/\r$//' config/rbac/role.yaml | sed -n '/^rules:/,$p') \
+  <(sed 's/\r$//' charts/node-readiness-controller/templates/rbac.yaml \
+    | sed -n '/^# BEGIN GENERATED RBAC RULES$/,/^# END GENERATED RBAC RULES$/{ /^# /d; p; }')
+echo "RBAC in the Helm chart matches config/rbac."