fix(kube-ovn): scope kubeovn-plunger cache and RBAC to its namespace

The kubeovn-plunger controller-runtime cache attempted cluster-wide
list/watch on Deployments and Pods, which the namespace-scoped Role
cannot satisfy. Additionally, the deployments rule relied on
resourceNames, which does not restrict list/watch verbs and left the
permission effectively unusable.

Scope the manager cache to the kube-ovn namespace so list/watch hit
the namespaced API, and drop resourceNames from the deployments rule.
Wire --kube-ovn-namespace and --ovn-central-name through the
Deployment so values are actually consumed.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

cmd/kubeovn-plunger/main.go

@@ -29,6 +29,7 @@ import (
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	"sigs.k8s.io/controller-runtime/pkg/metrics"
@@ -131,6 +132,11 @@ func main() {
 		HealthProbeBindAddress: probeAddr,
 		LeaderElection:         enableLeaderElection,
 		LeaderElectionID:       "29a0338b.cozystack.io",
+		Cache: cache.Options{
+			DefaultNamespaces: map[string]cache.Config{
+				kubeOVNNamespace: {},
+			},
+		},
 		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
 		// when the Manager ends. This requires the binary to immediately end when the
 		// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly

packages/system/kubeovn-plunger/templates/deployment.yaml

@@ -29,6 +29,8 @@ spec:
         {{- end }}
         - --metrics-bind-address=:8080
         - --metrics-secure=false
+        - --kube-ovn-namespace={{ .Release.Namespace }}
+        - --ovn-central-name={{ .Values.ovnCentralName }}
         ports:
         - name: metrics
           containerPort: 8080

packages/system/kubeovn-plunger/templates/rbac.yaml

@@ -22,8 +22,6 @@ rules:
   - get
   - list
   - watch
-  resourceNames:
-  - {{ .Values.ovnCentralName }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding