feat: verify chart RBAC does not drift from config/rbac

charts/node-readiness-controller/templates/rbac.yaml

@@ -36,25 +36,61 @@ metadata:
   name: {{ include "node-readiness-controller.fullname" . }}-manager-role
   labels:
     {{- include "node-readiness-controller.labels" . | nindent 4 }}
+# Copied verbatim from config/rbac/role.yaml (generated by controller-gen).
+# hack/verify-chart-drift.sh diffs the block between the BEGIN/END markers
+# against the generated file. Do not edit the rules by hand; run
+# `make manifests` and copy the output here.
+# BEGIN GENERATED RBAC RULES
 rules:
-  - apiGroups: ["", "events.k8s.io"]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list", "patch", "update", "watch"]
-  - apiGroups: [""]
-    resources: ["nodes/status"]
-    verbs: ["get"]
-  - apiGroups: ["readiness.node.x-k8s.io"]
-    resources: ["nodereadinessrules"]
-    verbs: ["get", "list", "patch", "update", "watch"]
-  - apiGroups: ["readiness.node.x-k8s.io"]
-    resources: ["nodereadinessrules/finalizers"]
-    verbs: ["update"]
-  - apiGroups: ["readiness.node.x-k8s.io"]
-    resources: ["nodereadinessrules/status"]
-    verbs: ["get", "patch", "update"]
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - nodes/status
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  - events.k8s.io
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+- apiGroups:
+  - readiness.node.x-k8s.io
+  resources:
+  - nodereadinessrules
+  verbs:
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - readiness.node.x-k8s.io
+  resources:
+  - nodereadinessrules/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - readiness.node.x-k8s.io
+  resources:
+  - nodereadinessrules/status
+  verbs:
+  - get
+  - patch
+  - update
+# END GENERATED RBAC RULES
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1

hack/verify-chart-drift.sh

@@ -28,3 +28,14 @@ make manifests
 diff -u \
   config/crd/bases/readiness.node.x-k8s.io_nodereadinessrules.yaml \
   charts/node-readiness-controller/crds/nodereadinessrules.readiness.node.x-k8s.io.yaml
+
+# ---------- RBAC drift ----------
+# The chart's manager ClusterRole carries a verbatim copy of the rules from
+# config/rbac/role.yaml, wrapped in BEGIN/END sentinel comments.  Extract that
+# block and diff it against the generated file.
+echo "Verifying chart manager RBAC matches config/rbac/role.yaml..."
+diff -u \
+  <(sed 's/\r$//' config/rbac/role.yaml | sed -n '/^rules:/,$p') \
+  <(sed 's/\r$//' charts/node-readiness-controller/templates/rbac.yaml \
+    | sed -n '/^# BEGIN GENERATED RBAC RULES$/,/^# END GENERATED RBAC RULES$/{ /^# /d; p; }')
+echo "RBAC in the Helm chart matches config/rbac."