ClusterRole permission issue with Admission plugin

[davidjaquier-imtf]

Hi!

I had to patch the clusterRole to make the reconciliation work with openshift.

Issue mentionned in controller logs:

2026-07-30T14:00:57.615593Z  WARN operator: src/lib.rs:254: controller reconcile stream item failed error=reconciler for object Tenant.v1alpha1.rustfs.com/test-tenant.test failed
2026-07-30T14:01:02.670677Z  WARN reconciling object{object.ref=Tenant.v1alpha1.rustfs.com/test-tenant.test object.reason=error policy requested retry}: operator::reconcile: src/reconcile.rs:569: reconcile failed; scheduling retry tenant=test-tenant namespace=Ok("test") reason="KubernetesApiError" requeue_seconds=5 error=Kubernetes API error: ApiError: roles.rbac.authorization.k8s.io "test-tenant-role" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: , <nil>: Forbidden (ErrorResponse { status: "Failure", message: "roles.rbac.authorization.k8s.io \"test-tenant-role\" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: , <nil>", reason: "Forbidden", code: 403 })

I fixed the clusterRole to add the rule

  - verbs:
      - update
    apiGroups:
      - rustfs.com
    resources:
      - tenants/finalizers

Then I had another problem, the tenant could not be created

Create Pod test-tenant-pool-0-0 in StatefulSet test-tenant-pool-0 failed error: pods "test-tenant-pool-0-0" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .spec.securityContext.fsGroup: Invalid value: [10001]: 10001 is not an allowed group, provider restricted-v2: .containers[0].runAsUser: Invalid value: 10001: must be in the ranges: [1000760000, 1000769999], provider restricted-v3: .spec.hostUsers: Invalid value: null: Host Users must be set to false, provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nested-container": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid-v2": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "insights-runtime-extractor-scc": Forbidden: not usable by user or serviceaccount, provider "node-exporter": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount]

In the tenant CRD, we can override the container security context, but not the pod security context.

Currently I patch manually the tenants but it could be good to be able to customize this.