Add pods/log RBAC for kubevirt datamover controller

[shubham-pampattiwar]

Summary

• Add pods/log get permission to the kubevirt datamover controller's ClusterRole
• The controller now collects pod logs from terminated datamover pods to surface error details in controller logs (Stream datamover pod logs to controller pod logs migtools/kubevirt-datamover-controller#52)

Details

Without this permission, the controller's log collection fails with a 403:

Warning: failed to collect datamover pod logs
"error": "pods \"...\" is forbidden: User \"system:serviceaccount:openshift-adp:oadp-kubevirt-datamover-controller-manager\" cannot get resource \"pods/log\" in API group \"\" in the namespace \"openshift-adp\""

The controller handles the RBAC failure gracefully (warns and continues), but the logs are lost.

Synced from migtools/kubevirt-datamover-controller config/rbac/role.yaml via make update-kubevirt-datamover-manifests, with unwanted RBAC changes from make bundle manually reverted per standard practice.

Test plan

• Verified controller logs show 403 without this permission
• make bundle generates the correct CSV entry
• Deploy operator with this change, run a kubevirt datamover backup, verify pod logs appear in controller logs

Related: migtools/kubevirt-datamover-controller#107

Summary by CodeRabbit

• Bug Fixes
  • Improved controller access to pod logs, supporting more reliable monitoring and troubleshooting of managed workloads.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

Walkthrough

The operator’s RBAC declarations now grant the non-admin controller service account read access to pod logs through the pods/log subresource.

Changes

Pod log RBAC access

Layer / File(s)	Summary
Add pod log permissions bundle/manifests/oadp-operator.clusterserviceversion.yaml, config/kubevirt-datamover-controller_rbac/role.yaml	Adds get access to the core API group’s pods/log subresource in both RBAC declarations.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: mpryc, joeavaikath, kaovilai

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit only changes two RBAC YAML manifests; no test files or Ginkgo titles were added or modified.
Test Structure And Quality	✅ Passed	PR only changes RBAC YAML; no Ginkgo tests were added or modified, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only changes RBAC YAML manifests, so MicroShift test compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only two RBAC YAML files changed; no .go/e2e/Ginkgo tests were added, so there are no new SNO-sensitive assumptions to review.
Topology-Aware Scheduling Compatibility	✅ Passed	Only RBAC pods/log get permissions were added; no changes to replicas, affinity, node selectors, taints, or topology spread.
Ote Binary Stdout Contract	✅ Passed	PR only changes RBAC YAML to add pods/log get; no main/suite code or stdout-writing entrypoint was touched.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo e2e tests were added or modified; only RBAC YAML changed, so there are no IPv4 or external-connectivity issues to flag.
No-Weak-Crypto	✅ Passed	Diff only adds pods/log get RBAC in two YAMLs; no crypto code, weak ciphers, custom crypto, or secret comparisons appear in the patch.
Container-Privileges	✅ Passed	Touched manifests only add RBAC for pods/log; no privileged/host* / allowPrivilegeEscalation / root settings are present.
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The diff only adds pods/log RBAC; no new logging statements or verbatim pod-log emission appear in the touched files.
Title check	✅ Passed	The title clearly states the main change: adding pods/log RBAC for the kubevirt datamover controller.
Description check	✅ Passed	The description explains the motivation and includes a test plan, even though it uses different headings than the template.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: shubham-pampattiwar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [shubham-pampattiwar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@shubham-pampattiwar: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/unit-test	5cfe7b0	link	true	/test unit-test
ci/prow/5.0-e2e-test-aws	5cfe7b0	link	true	/test 5.0-e2e-test-aws

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.