fix(rbac): fix RBAC role generation by adding dedicated rbac_markers.go

controller-gen v0.17.1 silently ignores markers in files that start with
a /* */ block comment (copyright header). Investigated by testing various
marker placements and comparing with chainversioncatalog_controller.go
which has no copyright header and works correctly.

Created rbac_markers.go without a copyright header as the single source
of truth for all RBAC markers. Removed duplicate markers from
blockchainnode_controller.go and nodehealth_controller.go. After fix,
make manifests correctly generates all required permissions including
blockchainnodes, statefulsets, services, configmaps, pods, podmonitors,
chainversioncatalogs, and endpoints.

Context: spent ~3h debugging CI E2E failures caused by missing RBAC
permissions; traced to controller-gen ignoring markers due to /* */ header

Author: tazhate

config/rbac/role.yaml

@@ -4,9 +4,81 @@ kind: ClusterRole
 metadata:
   name: manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - persistentvolumeclaims
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods/log
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - statefulsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - podmonitors
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - nodes.chainplane.io
   resources:
+  - blockchainnodes
   - chainversioncatalogs
   verbs:
   - create
@@ -19,12 +91,14 @@ rules:
 - apiGroups:
   - nodes.chainplane.io
   resources:
+  - blockchainnodes/finalizers
   - chainversioncatalogs/finalizers
   verbs:
   - update
 - apiGroups:
   - nodes.chainplane.io
   resources:
+  - blockchainnodes/status
   - chainversioncatalogs/status
   verbs:
   - get

internal/controller/blockchainnode_controller.go

@@ -51,17 +51,6 @@ const (
 
 // BlockchainNodeReconciler drives the full lifecycle of a BlockchainNode CR:
 // StatefulSet, Service, ConfigMap, health monitoring, and rolling upgrades.
-//
-// +kubebuilder:rbac:groups=nodes.chainplane.io,resources=blockchainnodes,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=nodes.chainplane.io,resources=blockchainnodes/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=nodes.chainplane.io,resources=blockchainnodes/finalizers,verbs=update
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups="",resources=services;configmaps;persistentvolumeclaims,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;patch;delete
-// +kubebuilder:rbac:groups="",resources=pods/log,verbs=get
-// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
-// +kubebuilder:rbac:groups="",resources=secrets,verbs=get
-// +kubebuilder:rbac:groups=monitoring.coreos.com,resources=podmonitors,verbs=get;list;watch;create;update;patch;delete
 type BlockchainNodeReconciler struct {
 	client.Client
 	APIReader     client.Reader
@@ -80,10 +69,6 @@ func (r *BlockchainNodeReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		Complete(r)
 }
 
-// Reconcile is the top-level entry point for a single reconciliation pass.
-// It follows a deterministic sequence: fetch CR, resolve adapter, handle
-// deletion, ensure finalizer, reconcile child resources, run upgrade logic,
-// and finally refresh the observed status.
 func (r *BlockchainNodeReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	logger := log.FromContext(ctx)
 

internal/controller/nodehealth_controller.go

@@ -54,14 +54,6 @@ const (
 // alongside BlockchainNodeReconciler without conflict: the main reconciler
 // manages the desired state (StatefulSet, Service, ConfigMap) while this one
 // handles health monitoring and blue/green replacement.
-//
-// +kubebuilder:rbac:groups=nodes.chainplane.io,resources=blockchainnodes,verbs=get;list;watch;patch
-// +kubebuilder:rbac:groups=nodes.chainplane.io,resources=blockchainnodes/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;create;delete;patch
-// +kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch
-// +kubebuilder:rbac:groups="",resources=endpoints,verbs=get;list;watch
-// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;delete
-// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
 type NodeHealthReconciler struct {
 	client.Client
 	Scheme      *runtime.Scheme

internal/controller/rbac_markers.go

@@ -0,0 +1,25 @@
+package controller
+
+// BlockchainNode controller RBAC
+
+// +kubebuilder:rbac:groups=nodes.chainplane.io,resources=blockchainnodes,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=nodes.chainplane.io,resources=blockchainnodes/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=nodes.chainplane.io,resources=blockchainnodes/finalizers,verbs=update
+// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups="",resources=services;configmaps;persistentvolumeclaims,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;patch;delete
+// +kubebuilder:rbac:groups="",resources=pods/log,verbs=get
+// +kubebuilder:rbac:groups="",resources=endpoints,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
+// +kubebuilder:rbac:groups="",resources=secrets,verbs=get
+// +kubebuilder:rbac:groups=monitoring.coreos.com,resources=podmonitors,verbs=get;list;watch;create;update;patch;delete
+
+// NodeHealth controller RBAC
+
+// +kubebuilder:rbac:groups=nodes.chainplane.io,resources=blockchainnodes,verbs=get;list;watch;patch
+// +kubebuilder:rbac:groups=nodes.chainplane.io,resources=blockchainnodes/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;create;delete;patch
+// +kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources=endpoints,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;delete
+// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch