From 04cc1633be6910e3c0d06f9621ab281f0c8dea02 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Tue, 21 Apr 2026 17:13:27 +0200
Subject: [PATCH] fix(kube-ovn): scope kubeovn-plunger cache and RBAC to its
 namespace

The kubeovn-plunger controller-runtime cache attempted cluster-wide
list/watch on Deployments and Pods, which the namespace-scoped Role
cannot satisfy. Additionally, the deployments rule relied on
resourceNames, which does not restrict list/watch verbs and left the
permission effectively unusable.

Scope the manager cache to the kube-ovn namespace so list/watch hit
the namespaced API, and drop resourceNames from the deployments rule.
Wire --kube-ovn-namespace and --ovn-central-name through the
Deployment so values are actually consumed.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 cmd/kubeovn-plunger/main.go                               | 6 ++++++
 packages/system/kubeovn-plunger/templates/deployment.yaml | 2 ++
 packages/system/kubeovn-plunger/templates/rbac.yaml       | 2 --
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/cmd/kubeovn-plunger/main.go b/cmd/kubeovn-plunger/main.go
index 210405ce..611d030b 100644
--- a/cmd/kubeovn-plunger/main.go
+++ b/cmd/kubeovn-plunger/main.go
@@ -29,6 +29,7 @@ import (
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	"sigs.k8s.io/controller-runtime/pkg/metrics"
@@ -131,6 +132,11 @@ func main() {
 		HealthProbeBindAddress: probeAddr,
 		LeaderElection:         enableLeaderElection,
 		LeaderElectionID:       "29a0338b.cozystack.io",
+		Cache: cache.Options{
+			DefaultNamespaces: map[string]cache.Config{
+				kubeOVNNamespace: {},
+			},
+		},
 		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
 		// when the Manager ends. This requires the binary to immediately end when the
 		// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
diff --git a/packages/system/kubeovn-plunger/templates/deployment.yaml b/packages/system/kubeovn-plunger/templates/deployment.yaml
index 183e8c5e..37b49620 100644
--- a/packages/system/kubeovn-plunger/templates/deployment.yaml
+++ b/packages/system/kubeovn-plunger/templates/deployment.yaml
@@ -29,6 +29,8 @@ spec:
         {{- end }}
         - --metrics-bind-address=:8080
         - --metrics-secure=false
+        - --kube-ovn-namespace={{ .Release.Namespace }}
+        - --ovn-central-name={{ .Values.ovnCentralName }}
         ports:
         - name: metrics
           containerPort: 8080
diff --git a/packages/system/kubeovn-plunger/templates/rbac.yaml b/packages/system/kubeovn-plunger/templates/rbac.yaml
index a0c5527b..3ca22740 100644
--- a/packages/system/kubeovn-plunger/templates/rbac.yaml
+++ b/packages/system/kubeovn-plunger/templates/rbac.yaml
@@ -22,8 +22,6 @@ rules:
   - get
   - list
   - watch
-  resourceNames:
-  - {{ .Values.ovnCentralName }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding