From 59c9a11aa5190e2fc9c401d848fde60fea50ca35 Mon Sep 17 00:00:00 2001 From: Pavel Tishkov Date: Tue, 23 Jun 2026 21:41:52 +0300 Subject: [PATCH] fix(rbac): grant kubevirt-operator pods/resize update for inplace resize virt-operator (SA kubevirt-operator) generates the ClusterRole kubevirt-internal-virtualization-controller with a pods/resize:update rule (upstream kubevirt 1.6.2 inplace resize feature, PR #103 in 3p-kubevirt). On apply, Kubernetes RBAC escalation protection blocks it because the operator's own ClusterRole d8:virtualization:kubevirt-operator does not hold that right, so the kubevirt install-strategy never rolls out and virt-handler/virt-controller stay on the old image. Add pods/resize:update to d8:virtualization:kubevirt-operator next to the existing pods/finalizers:update rule. Safe on all k8s versions: RBAC does not validate subresource existence; on clusters where the InPlacePodVerticalScaling subresource is absent, the rule is inert. Signed-off-by: Pavel Tishkov --- templates/kubevirt/virt-operator/rbac-for-us.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/templates/kubevirt/virt-operator/rbac-for-us.yaml b/templates/kubevirt/virt-operator/rbac-for-us.yaml index c3c7b0119a..34bbe2b02f 100644 --- a/templates/kubevirt/virt-operator/rbac-for-us.yaml +++ b/templates/kubevirt/virt-operator/rbac-for-us.yaml @@ -502,6 +502,12 @@ rules: - pods/finalizers verbs: - update +- apiGroups: + - "" + resources: + - pods/resize + verbs: + - update - apiGroups: - "" resources: