From ae6bfc58405d851f16b0ec648207c1b78e852c9f Mon Sep 17 00:00:00 2001
From: Rahul Sharma <rahulsharm@nvidia.com>
Date: Tue, 4 Aug 2026 07:42:12 -0700
Subject: [PATCH] fix node permissions for computedomain plugin

Signed-off-by: Rahul Sharma <rahulsharm@nvidia.com>
---
 .../gpucluster-dra-driver-full-spec.yaml      | 38 ++++++++++++++-----
 .../gpucluster-dra-driver-gpus-only.yaml      |  9 -----
 ...luster-dra-driver-passthrough-support.yaml |  9 -----
 ...0130_kubeletplugin-computedomain-role.yaml | 29 ++++++++++++++
 .../0200_kubeletplugin-clusterrole.yaml       |  9 -----
 5 files changed, 58 insertions(+), 36 deletions(-)

diff --git a/internal/state/testdata/golden/gpucluster-dra-driver-full-spec.yaml b/internal/state/testdata/golden/gpucluster-dra-driver-full-spec.yaml
index cf0faf0820..e735a6aedf 100644
--- a/internal/state/testdata/golden/gpucluster-dra-driver-full-spec.yaml
+++ b/internal/state/testdata/golden/gpucluster-dra-driver-full-spec.yaml
@@ -188,6 +188,35 @@ subjects:
   namespace: test-operator
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: nvidia-dra-driver-kubeletplugin-computedomain
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: nvidia-dra-driver-kubeletplugin-computedomain
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: nvidia-dra-driver-kubeletplugin-computedomain
+subjects:
+- kind: ServiceAccount
+  name: nvidia-dra-driver-kubeletplugin
+  namespace: test-operator
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: nvidia-dra-driver-kubeletplugin
@@ -306,15 +335,6 @@ rules:
   - create
   - update
   - delete
-- apiGroups:
-  - ""
-  resources:
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
-  - update
 - apiGroups:
   - ""
   resources:
diff --git a/internal/state/testdata/golden/gpucluster-dra-driver-gpus-only.yaml b/internal/state/testdata/golden/gpucluster-dra-driver-gpus-only.yaml
index a5f822d887..76b6c6c7e8 100644
--- a/internal/state/testdata/golden/gpucluster-dra-driver-gpus-only.yaml
+++ b/internal/state/testdata/golden/gpucluster-dra-driver-gpus-only.yaml
@@ -99,15 +99,6 @@ rules:
   - create
   - update
   - delete
-- apiGroups:
-  - ""
-  resources:
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
-  - update
 - apiGroups:
   - ""
   resources:
diff --git a/internal/state/testdata/golden/gpucluster-dra-driver-passthrough-support.yaml b/internal/state/testdata/golden/gpucluster-dra-driver-passthrough-support.yaml
index 967fc51750..a6045c4123 100644
--- a/internal/state/testdata/golden/gpucluster-dra-driver-passthrough-support.yaml
+++ b/internal/state/testdata/golden/gpucluster-dra-driver-passthrough-support.yaml
@@ -99,15 +99,6 @@ rules:
   - create
   - update
   - delete
-- apiGroups:
-  - ""
-  resources:
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
-  - update
 - apiGroups:
   - ""
   resources:
diff --git a/manifests/state-dra-driver/0130_kubeletplugin-computedomain-role.yaml b/manifests/state-dra-driver/0130_kubeletplugin-computedomain-role.yaml
index f59418bb9f..1a322ff05d 100644
--- a/manifests/state-dra-driver/0130_kubeletplugin-computedomain-role.yaml
+++ b/manifests/state-dra-driver/0130_kubeletplugin-computedomain-role.yaml
@@ -1,5 +1,34 @@
 {{- if .DRADriver.Spec.IsComputeDomainsEnabled }}
 apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: nvidia-dra-driver-kubeletplugin-computedomain
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: nvidia-dra-driver-kubeletplugin-computedomain
+subjects:
+- kind: ServiceAccount
+  name: nvidia-dra-driver-kubeletplugin
+  namespace: {{ .Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: nvidia-dra-driver-kubeletplugin-computedomain
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: nvidia-dra-driver-kubeletplugin
diff --git a/manifests/state-dra-driver/0200_kubeletplugin-clusterrole.yaml b/manifests/state-dra-driver/0200_kubeletplugin-clusterrole.yaml
index 850940f91d..2a4051c53a 100644
--- a/manifests/state-dra-driver/0200_kubeletplugin-clusterrole.yaml
+++ b/manifests/state-dra-driver/0200_kubeletplugin-clusterrole.yaml
@@ -30,15 +30,6 @@ rules:
   - create
   - update
   - delete
-- apiGroups:
-  - ""
-  resources:
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
-  - update
 - apiGroups:
   - ""
   resources: