charts/redpanda, multicluster: deduplicate RBAC

.changes/unreleased/charts-redpanda-Fixed-20261009-120000.yaml

@@ -0,0 +1,7 @@
+project: charts/redpanda
+kind: Fixed
+body: |-
+    `ClusterRole` and `ClusterRoleBinding` names are no longer truncated to 63
+    characters. When `<fullname>-<namespace>` reached that limit, every
+    `ClusterRole` rendered under the same name, overwriting each other's rules.
+time: 2026-10-09T12:00:00.000000-04:00

.changes/unreleased/operator-Changed-20260916-153000.yaml

@@ -0,0 +1,14 @@
+project: operator
+kind: Changed
+body: |-
+    StretchCluster's per-pool sidecar `Role` no longer grants read on `pods` or
+    `apps/statefulsets`, and its rack-awareness `ClusterRole` no longer grants
+    `list` or `watch` on `nodes`. The operator's own `ClusterRole` drops the same
+    `nodes` verbs on multicluster installs.
+
+      The sidecar only ever ran the broker probe there, which talks to the Redpanda
+      Admin API rather than the Kubernetes one; the controllers that read those
+      resources are gated behind flags the StretchCluster renderer doesn't pass.
+      Rack awareness only ever `get`s the broker's own `Node`. The operator owns
+      these objects, so they narrow on upgrade with no action needed.
+time: 2026-09-16T15:30:00-04:00

.changes/unreleased/operator-Fixed-20261009-120000.yaml

@@ -0,0 +1,8 @@
+project: operator
+kind: Fixed
+body: |-
+    StretchCluster `ClusterRole` and `ClusterRoleBinding` names are no longer
+    truncated to 63 characters. When `<pool fullname>-<namespace>` reached that
+    limit, a pool's `ClusterRole`s rendered under the same name, overwriting each
+    other's rules.
+time: 2026-10-09T12:00:00.000000-04:00

charts/redpanda/chart/chart.go

@@ -151,21 +151,7 @@ func renderResources(state *RenderState) []kube.Object {
 		manifests = append(manifests, obj)
 	}
 
-	for _, obj := range Roles(state) {
-		manifests = append(manifests, obj)
-	}
-
-	for _, obj := range ClusterRoles(state) {
-		manifests = append(manifests, obj)
-	}
-
-	for _, obj := range RoleBindings(state) {
-		manifests = append(manifests, obj)
-	}
-
-	for _, obj := range ClusterRoleBindings(state) {
-		manifests = append(manifests, obj)
-	}
+	manifests = append(manifests, RoleSet(state).Render()...)
 
 	for _, obj := range LoadBalancerServices(state) {
 		manifests = append(manifests, obj)
@@ -195,7 +181,6 @@ func renderResources(state *RenderState) []kube.Object {
 //
 //go:embed Chart.lock
 //go:embed Chart.yaml
-//go:embed files/*
 //go:embed templates/*
 //go:embed values.schema.json
 //go:embed values.yaml

charts/redpanda/chart/rbac.go

@@ -11,156 +11,37 @@
 package chart
 
 import (
-	"fmt"
-
-	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
+	"github.com/redpanda-data/redpanda-operator/charts/redpanda/v25"
 	"github.com/redpanda-data/redpanda-operator/gotohelm/helmette"
 )
 
-func Roles(state *RenderState) []*rbacv1.Role {
-	// path of static role definition -> Enabled
-	mapping := map[string]bool{
-		"files/sidecar.Role.yaml":          state.Values.RBAC.Enabled,
-		"files/pvcunbinder.Role.yaml":      state.Values.RBAC.Enabled && state.Values.Statefulset.SideCars.PVCUnbinder.Enabled,
-		"files/decommission.Role.yaml":     state.Values.RBAC.Enabled && state.Values.Statefulset.SideCars.BrokerDecommissioner.Enabled,
-		"files/rpk-debug-bundle.Role.yaml": state.Values.RBAC.Enabled && state.Values.RBAC.RPKDebugBundle,
-	}
-
-	var roles []*rbacv1.Role
-	for file, enabled := range helmette.SortedMap(mapping) {
-		if !enabled {
-			continue
-		}
-
-		role := helmette.FromYaml[rbacv1.Role](state.Dot.Files.Get(file))
-
-		// Populated all chart values on the loaded static Role.
-		role.ObjectMeta.Name = fmt.Sprintf("%s-%s", Fullname(state), role.ObjectMeta.Name)
-		role.ObjectMeta.Namespace = state.Release.Namespace
-		role.ObjectMeta.Labels = FullLabels(state)
-		role.ObjectMeta.Annotations = helmette.Merge(
-			map[string]string{},
-			state.Values.ServiceAccount.Annotations, // For backwards compatibility
-			state.Values.RBAC.Annotations,
-			FullAnnotations(state),
-		)
-
-		roles = append(roles, &role)
+// RoleSet resolves this chart's values into the shared RBAC set, which never
+// sees chart values. It is the chart's one translation function for everything
+// RBAC shaped.
+func RoleSet(state *RenderState) *redpanda.RoleSet {
+	annotations := helmette.Merge(
+		map[string]string{},
+		state.Values.ServiceAccount.Annotations, // For backwards compatibility
+		state.Values.RBAC.Annotations,
+		FullAnnotations(state),
+	)
+
+	return &redpanda.RoleSet{
+		Prefix:         Fullname(state),
+		Namespace:      state.Release.Namespace,
+		Labels:         FullLabels(state),
+		Annotations:    annotations,
+		ServiceAccount: ServiceAccountName(state),
+		Roles: redpanda.Roles{
+			Decommission:   state.Values.RBAC.Enabled && state.Values.Statefulset.SideCars.BrokerDecommissioner.Enabled,
+			PVCUnbinder:    state.Values.RBAC.Enabled && state.Values.Statefulset.SideCars.PVCUnbinder.Enabled,
+			RPKDebugBundle: state.Values.RBAC.Enabled && state.Values.RBAC.RPKDebugBundle,
+			Sidecar:        state.Values.RBAC.Enabled,
+		},
+		ClusterRoles: redpanda.ClusterRoles{
+			Decommission:  state.Values.RBAC.Enabled && state.Values.Statefulset.SideCars.BrokerDecommissioner.Enabled,
+			PVCUnbinder:   state.Values.RBAC.Enabled && state.Values.Statefulset.SideCars.PVCUnbinder.Enabled,
+			RackAwareness: state.Values.RBAC.Enabled && state.Values.RackAwareness.Enabled,
+		},
 	}
-
-	return roles
-}
-
-func ClusterRoles(state *RenderState) []*rbacv1.ClusterRole {
-	// path of static ClusterRole definition -> Enabled
-	mapping := map[string]bool{
-		"files/pvcunbinder.ClusterRole.yaml":    state.Values.RBAC.Enabled && state.Values.Statefulset.SideCars.PVCUnbinder.Enabled,
-		"files/decommission.ClusterRole.yaml":   state.Values.RBAC.Enabled && state.Values.Statefulset.SideCars.BrokerDecommissioner.Enabled,
-		"files/rack-awareness.ClusterRole.yaml": state.Values.RBAC.Enabled && state.Values.RackAwareness.Enabled,
-	}
-
-	var clusterRoles []*rbacv1.ClusterRole
-	for file, enabled := range helmette.SortedMap(mapping) {
-		if !enabled {
-			continue
-		}
-
-		role := helmette.FromYaml[rbacv1.ClusterRole](state.Dot.Files.Get(file))
-
-		// Populated all chart values on the loaded static Role.
-		// For ClusterScoped resources, we include the Namespace to permit
-		// installing multiple releases with the same names into the same
-		// cluster.
-		role.ObjectMeta.Name = cleanForK8s(fmt.Sprintf("%s-%s-%s", Fullname(state), state.Release.Namespace, role.ObjectMeta.Name))
-		role.ObjectMeta.Labels = FullLabels(state)
-		role.ObjectMeta.Annotations = helmette.Merge(
-			map[string]string{},
-			state.Values.ServiceAccount.Annotations, // For backwards compatibility
-			state.Values.RBAC.Annotations,
-			FullAnnotations(state),
-		)
-
-		clusterRoles = append(clusterRoles, &role)
-	}
-
-	return clusterRoles
-}
-
-func RoleBindings(state *RenderState) []*rbacv1.RoleBinding {
-	// Rather than worrying about syncing logic, we just generate the list of
-	// bindings from the roles that we create.
-	var roleBindings []*rbacv1.RoleBinding
-	for _, role := range Roles(state) {
-		roleBindings = append(roleBindings, &rbacv1.RoleBinding{
-			TypeMeta: metav1.TypeMeta{
-				APIVersion: "rbac.authorization.k8s.io/v1",
-				Kind:       "RoleBinding",
-			},
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      role.ObjectMeta.Name,
-				Labels:    FullLabels(state),
-				Namespace: state.Release.Namespace,
-				Annotations: helmette.Merge(
-					map[string]string{},
-					state.Values.ServiceAccount.Annotations, // For backwards compatibility
-					state.Values.RBAC.Annotations,
-					FullAnnotations(state),
-				),
-			},
-			RoleRef: rbacv1.RoleRef{
-				APIGroup: "rbac.authorization.k8s.io",
-				Kind:     "Role",
-				Name:     role.ObjectMeta.Name,
-			},
-			Subjects: []rbacv1.Subject{
-				{
-					Kind:      "ServiceAccount",
-					Name:      ServiceAccountName(state),
-					Namespace: state.Release.Namespace,
-				},
-			},
-		})
-	}
-
-	return roleBindings
-}
-
-func ClusterRoleBindings(state *RenderState) []*rbacv1.ClusterRoleBinding {
-	// Rather than worrying about syncing logic, we just generate the list of
-	// bindings from the roles that we create.
-	var crbs []*rbacv1.ClusterRoleBinding
-	for _, clusterRole := range ClusterRoles(state) {
-		crbs = append(crbs, &rbacv1.ClusterRoleBinding{
-			TypeMeta: metav1.TypeMeta{
-				APIVersion: "rbac.authorization.k8s.io/v1",
-				Kind:       "ClusterRoleBinding",
-			},
-			ObjectMeta: metav1.ObjectMeta{
-				Name:   clusterRole.ObjectMeta.Name,
-				Labels: FullLabels(state),
-				Annotations: helmette.Merge(
-					map[string]string{},
-					state.Values.ServiceAccount.Annotations, // For backwards compatibility
-					state.Values.RBAC.Annotations,
-					FullAnnotations(state),
-				),
-			},
-			RoleRef: rbacv1.RoleRef{
-				APIGroup: "rbac.authorization.k8s.io",
-				Kind:     "ClusterRole",
-				Name:     clusterRole.ObjectMeta.Name,
-			},
-			Subjects: []rbacv1.Subject{
-				{
-					Kind:      "ServiceAccount",
-					Name:      ServiceAccountName(state),
-					Namespace: state.Release.Namespace,
-				},
-			},
-		})
-	}
-
-	return crbs
 }

charts/redpanda/chart/serviceaccount.go

@@ -12,9 +12,8 @@ package chart
 
 import (
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/utils/ptr"
 
+	"github.com/redpanda-data/redpanda-operator/charts/redpanda/v25"
 	"github.com/redpanda-data/redpanda-operator/gotohelm/helmette"
 )
 
@@ -38,17 +37,10 @@ func ServiceAccount(state *RenderState) *corev1.ServiceAccount {
 		return nil
 	}
 
-	return &corev1.ServiceAccount{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: "v1",
-			Kind:       "ServiceAccount",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name:        ServiceAccountName(state),
-			Namespace:   state.Release.Namespace,
-			Labels:      FullLabels(state),
-			Annotations: helmette.Merge(state.Values.ServiceAccount.Annotations, FullAnnotations(state)),
-		},
-		AutomountServiceAccountToken: ptr.To(false),
-	}
+	return redpanda.ServiceAccount(
+		ServiceAccountName(state),
+		state.Release.Namespace,
+		FullLabels(state),
+		helmette.Merge(state.Values.ServiceAccount.Annotations, FullAnnotations(state)),
+	)
 }