add new RBAC verbs

Signed-off-by: Benny Zlotnik <bzlotnik@redhat.com>

Author: bennyz

controller/deploy/operator/config/rbac/role.yaml

@@ -243,10 +243,11 @@ rules:
   - virtualtarget.jumpstarter.dev
   resources:
   - exportersets
-  - virtualtargetclasses
   verbs:
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - virtualtarget.jumpstarter.dev
@@ -263,3 +264,11 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - virtualtarget.jumpstarter.dev
+  resources:
+  - virtualtargetclasses
+  verbs:
+  - get
+  - list
+  - watch

controller/deploy/operator/internal/controller/jumpstarter/exporterset.go

@@ -490,7 +490,7 @@ func exporterSetPolicyRules() []rbacv1.PolicyRule {
 		{
 			APIGroups: []string{"virtualtarget.jumpstarter.dev"},
 			Resources: []string{"exportersets"},
-			Verbs:     []string{"get", "list", "watch"},
+			Verbs:     []string{"get", "list", "watch", "update", "patch"},
 		},
 		{
 			APIGroups: []string{"virtualtarget.jumpstarter.dev"},

controller/deploy/operator/internal/controller/jumpstarter/exporterset_test.go

@@ -120,22 +120,20 @@ var _ = Describe("exporterSetPolicyRules", func() {
 		Expect(groups).To(HaveKey("coordination.k8s.io"))
 	})
 
-	It("should grant read-only access on exportersets (no create/update/delete)", func() {
+	It("should grant read+update+patch access on exportersets (no create/delete)", func() {
 		for _, rule := range rules {
 			if containsString(rule.APIGroups, "virtualtarget.jumpstarter.dev") &&
 				containsString(rule.Resources, "exportersets") &&
 				!containsString(rule.Resources, "exportersets/status") &&
 				!containsString(rule.Resources, "exportersets/scale") &&
 				!containsString(rule.Resources, "exportersets/finalizers") {
-				Expect(rule.Verbs).To(ContainElements("get", "list", "watch"))
+				Expect(rule.Verbs).To(ContainElements("get", "list", "watch", "update", "patch"))
 				Expect(rule.Verbs).NotTo(ContainElement("create"))
-				Expect(rule.Verbs).NotTo(ContainElement("update"))
-				Expect(rule.Verbs).NotTo(ContainElement("patch"))
 				Expect(rule.Verbs).NotTo(ContainElement("delete"))
 				return
 			}
 		}
-		Fail("no rule found granting read-only access on exportersets")
+		Fail("no rule found granting read+update+patch access on exportersets")
 	})
 
 	It("should grant status/scale/finalizer access on exportersets", func() {

controller/deploy/operator/internal/controller/jumpstarter/jumpstarter_controller.go

@@ -126,7 +126,7 @@ type JumpstarterReconciler struct {
 
 // virtualtarget.jumpstarter.dev CRD resources (needed to grant permissions to managed
 // exporter-set provisioner controllers, see exporterSetPolicyRules)
-// +kubebuilder:rbac:groups=virtualtarget.jumpstarter.dev,resources=exportersets,verbs=get;list;watch
+// +kubebuilder:rbac:groups=virtualtarget.jumpstarter.dev,resources=exportersets,verbs=get;list;watch;update;patch
 // +kubebuilder:rbac:groups=virtualtarget.jumpstarter.dev,resources=exportersets/status;exportersets/scale,verbs=get;update;patch
 // +kubebuilder:rbac:groups=virtualtarget.jumpstarter.dev,resources=exportersets/finalizers,verbs=update
 // +kubebuilder:rbac:groups=virtualtarget.jumpstarter.dev,resources=virtualtargetclasses,verbs=get;list;watch

controller/hack/utils

@@ -18,6 +18,7 @@ export CLUSTER_TYPE=${CLUSTER_TYPE:-kind}
 export K3S_KUBECONFIG=${K3S_KUBECONFIG:-/etc/rancher/k3s/k3s.yaml}
 
 # Color codes for terminal output
+export RED='\033[0;31m'
 export GREEN='\033[0;32m'
 export YELLOW='\033[1;33m'
 export NC='\033[0m' # No Color
@@ -226,16 +227,40 @@ wait_for_jumpstarter_resources() {
 
   # Wait for controller deployment to be ready
   echo -e "${GREEN} * Waiting for controller deployment to be ready ...${NC}"
-  kubectl wait --namespace "${namespace}" \
+  if ! kubectl wait --namespace "${namespace}" \
     --for=condition=available deployment/jumpstarter-controller \
-    --timeout=180s
+    --timeout=180s; then
+    echo -e "${RED} * Controller deployment failed to become available. Collecting diagnostics ...${NC}"
+    echo "--- Deployment status ---"
+    kubectl get deployment jumpstarter-controller -n "${namespace}" -o wide 2>&1 || true
+    echo "--- Pod status ---"
+    kubectl get pods -n "${namespace}" -l app=jumpstarter-controller -o wide 2>&1 || true
+    echo "--- Pod describe ---"
+    kubectl describe pods -n "${namespace}" -l app=jumpstarter-controller 2>&1 || true
+    echo "--- Pod logs ---"
+    kubectl logs -n "${namespace}" -l app=jumpstarter-controller --tail=100 2>&1 || true
+    echo "--- Events ---"
+    kubectl get events -n "${namespace}" --sort-by='.lastTimestamp' --field-selector reason!=Pulling 2>&1 | tail -30 || true
+    echo "--- Operator logs (last 50 lines) ---"
+    kubectl logs -n jumpstarter-operator-system -l control-plane=controller-manager --tail=50 2>&1 || true
+    exit 1
+  fi
 
   # Wait for router statefulset to be ready
   echo -e "${GREEN} * Waiting for router pods to be ready ...${NC}"
-  kubectl wait --namespace "${namespace}" \
+  if ! kubectl wait --namespace "${namespace}" \
     --for=condition=ready pod \
     --selector=app=jumpstarter-router-0 \
-    --timeout=180s
+    --timeout=180s; then
+    echo -e "${RED} * Router pods failed to become ready. Collecting diagnostics ...${NC}"
+    echo "--- Pod status ---"
+    kubectl get pods -n "${namespace}" -l app=jumpstarter-router-0 -o wide 2>&1 || true
+    echo "--- Pod describe ---"
+    kubectl describe pods -n "${namespace}" -l app=jumpstarter-router-0 2>&1 || true
+    echo "--- Pod logs ---"
+    kubectl logs -n "${namespace}" -l app=jumpstarter-router-0 --tail=100 2>&1 || true
+    exit 1
+  fi
 }
 
 # Wait for gRPC endpoint to be ready