Add datadownloads RBAC to kubevirt-datamover ClusterRole

[kaovilai]

Why the changes were made

The ClusterRole bound to oadp-kubevirt-datamover-controller-manager was missing RBAC for datadownloads/datadownloads/status, which Phase 3 (DataDownload) support in kubevirt-datamover-controller (migtools/kubevirt-datamover-controller#124) needs. Without it, the controller-runtime cache's watch on DataDownload fails continuously with:

datadownloads.velero.io is forbidden: ... cannot list resource "datadownloads" ... at the cluster scope

This stalls the entire manager's reconcile loop — not just DataDownload, but DataUpload too, since they share one cache/manager process.

config/kubevirt-datamover-controller_rbac/role.yaml is updated to match upstream's config/rbac/role.yaml (adding datadownloads/datadownloads/status to the existing datauploads/datauploads/status rule blocks), and make bundle was re-run to propagate the change into the CSV.

Fixes #2351

How to test the changes made

Deploy, then:

oc logs deployment/oadp-kubevirt-datamover-controller-manager -n openshift-adp

should show no Failed to watch ... datadownloads errors, and a DataUpload created via a real velero backup should progress past an empty status.phase.

Summary by CodeRabbit

• Bug Fixes
  • Improved KubeVirt data mover support by enabling required access to Velero data download resources.
  • Helps ensure data transfer operations can be monitored and managed reliably.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: af7aa56c-0591-403d-98ed-343d18db70f2

📥 Commits

Reviewing files that changed from the base of the PR and between 789130a and e8f0c85.

📒 Files selected for processing (2)

• bundle/manifests/oadp-operator.clusterserviceversion.yaml
• config/kubevirt-datamover-controller_rbac/role.yaml

---

Walkthrough

The kubevirt-datamover controller RBAC now includes Velero datadownloads and datadownloads/status resources in both the source ClusterRole and bundled CSV.

Changes

DataDownload RBAC

Layer / File(s)	Summary
Controller RBAC and bundle permissions config/kubevirt-datamover-controller_rbac/role.yaml, bundle/manifests/oadp-operator.clusterserviceversion.yaml	The ClusterRole and bundled CSV add datadownloads and datadownloads/status alongside the existing DataUpload permissions.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: shubham-pampattiwar

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the addition of DataDownload RBAC permissions to the kubevirt-datamover ClusterRole.
Description check	✅ Passed	The description explains the problem, implemented changes, linked issue, regeneration step, and verification procedure.
Linked Issues check	✅ Passed	The changes add all required datadownloads and datadownloads/status permissions and regenerate the bundle CSV for issue #2351.
Out of Scope Changes check	✅ Passed	The changes are limited to the requested ClusterRole permissions and the corresponding generated bundle CSV.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Stable And Deterministic Test Names	✅ Passed	The commit changes only two YAML RBAC manifests. No Ginkgo test files, declarations, or test titles were added or modified.
Test Structure And Quality	✅ Passed	Not applicable: the commit changes only two YAML RBAC manifests and adds no Ginkgo tests or cluster operations to review.
Microshift Test Compatibility	✅ Passed	The commit changes only two RBAC YAML files and adds no Ginkgo e2e tests or other test constructs to assess for MicroShift compatibility.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only two RBAC YAML files; it adds no Ginkgo tests or other test files requiring SNO compatibility review.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff adds only Velero RBAC resources in two YAML files; it introduces no affinity, topology spread, node selectors, tolerations, PDB, or replica scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The pull request changes only two YAML RBAC manifests; it adds DataDownload permissions and does not modify a binary, main(), or suite setup that could write stdout.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only two RBAC YAML files; the complete diff contains no test paths or new Ginkgo declarations, so this check is not applicable.
No-Weak-Crypto	✅ Passed	The patch changes only two YAML RBAC files by adding Velero datadownload permissions; no weak-crypto, custom crypto, or secret-comparison code is added.
Container-Privileges	✅ Passed	The PR adds only datadownloads RBAC resource entries; no privileged:true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation:true settings are added.
No-Sensitive-Data-In-Logs	✅ Passed	The PR changes only two YAML RBAC declarations, adding datadownloads resources; no logging statements or sensitive data are added.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[shubham-pampattiwar]

/lgtm

[kaovilai]

/cherry-pick oadp-1.6

[openshift-cherrypick-robot]

@kaovilai: once the present PR merges, I will cherry-pick it on top of oadp-1.6 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick oadp-1.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Joeavaikath, kaovilai, shubham-pampattiwar, sseago

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [Joeavaikath,kaovilai,shubham-pampattiwar,sseago]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@kaovilai: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-cherrypick-robot]

@kaovilai: new pull request created: #2354

Details

In response to this:

/cherry-pick oadp-1.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.