ROSAENG-64532: remove CDO rebalancer RoleBinding (fixes OHSS-58441)

[aliceh]

Summary

Minimal fix for OHSS-58441: delete the single RoleBinding that targets namespace: openshift-custom-domains-operator.

Phase 1 of the CDO decommission (ROSAENG-64532) removed the CDO namespace from clusters without the custom-domains-operator/keep label. The osd-rebalance-infra-nodes-non-fr SSS still applies this RoleBinding to that namespace, causing ClusterSync failure on hibernation resume and blocking LS auto-clear.

This is the only file causing the ClusterSync failure. It grants the infra-node rebalancer access to the CDO namespace — it is not used by any other operator or service.

Extracted from PR #2869 (full MCC CDO cleanup, still under review) to unblock the immediate operational impact.

What this does NOT touch

• No shared resources (ConfigMaps, recording rules, managed namespace list, all-osd-resources)
• No hack/ template regeneration needed (non-fr/ uses resourceApplyMode: Upsert)
• CDO itself (deployed by PKO via app-interface) is unaffected

Test plan

• CI passes
• Verify ClusterSync no longer fails on clusters where CDO namespace is absent

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
  • Removed the role binding for the OpenShift custom domains operator pod rebalance configuration.

[openshift-ci-robot]

@aliceh: This pull request references ROSAENG-64532 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

Minimal fix for OHSS-58441: delete the single RoleBinding that targets namespace: openshift-custom-domains-operator.

Phase 1 of the CDO decommission (ROSAENG-64532) removed the CDO namespace from clusters without the custom-domains-operator/keep label. The osd-rebalance-infra-nodes-non-fr SSS still applies this RoleBinding to that namespace, causing ClusterSync failure on hibernation resume and blocking LS auto-clear.

This is the only file causing the ClusterSync failure. It grants the infra-node rebalancer access to the CDO namespace — it is not used by any other operator or service.

Extracted from PR #2869 (full MCC CDO cleanup, still under review) to unblock the immediate operational impact.

What this does NOT touch

• No shared resources (ConfigMaps, recording rules, managed namespace list, all-osd-resources)
• No hack/ template regeneration needed (non-fr/ uses resourceApplyMode: Upsert)
• CDO itself (deployed by PKO via app-interface) is unaffected

Test plan

• CI passes
• Verify ClusterSync no longer fails on clusters where CDO namespace is absent

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 579c0998-1492-494f-84e7-dd3901377556

📥 Commits

Reviewing files that changed from the base of the PR and between 0599983 and 41071eb.

📒 Files selected for processing (1)

• deploy/osd-rebalance-infra-nodes/non-fr/06-openshift-custom-domains-operator-pod-rebalance.RoleBinding.yaml

💤 Files with no reviewable changes (1)

• deploy/osd-rebalance-infra-nodes/non-fr/06-openshift-custom-domains-operator-pod-rebalance.RoleBinding.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The pull request deletes the RoleBinding that granted the osd-rebalance-infra-nodes service account access to the pod-rebalance ClusterRole.

Changes

OSD rebalance RBAC

Layer / File(s)	Summary
Remove pod-rebalance RoleBinding deploy/osd-rebalance-infra-nodes/non-fr/06-openshift-custom-domains-operator-pod-rebalance.RoleBinding.yaml	The RoleBinding was deleted. The service account is no longer bound to the pod-rebalance ClusterRole through this resource.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 41071

The change removes the obsolete RoleBinding described in the PR scope, with no unresolved concrete risk identified.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the removal of the CDO rebalancer RoleBinding and includes the related issue references. It accurately summarizes the primary change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The review range changes only one YAML manifest. It deletes a Kubernetes RoleBinding and adds no code or Ginkgo test titles. Therefore, the stable and deterministic test-name check is not violated.
Test Structure And Quality	✅ Passed	PASS: The pull request only deletes one YAML RoleBinding declaration. The authoritative diff contains no Ginkgo test file, test code, or Ginkgo symbols. Therefore the listed test-quality requirements …
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only one YAML file and deletes a RoleBinding. The authoritative diff adds no Ginkgo e2e tests, test constructs, or test references to MicroShift-unsupported APIs or feat…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS. The pull request changes only one Kubernetes YAML file and deletes a RoleBinding. It adds no Ginkgo e2e tests or other test code, so the SNO test compatibility criteria do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — The reviewed range deletes one RoleBinding and changes no deployment, pod, replica, affinity, topology spread, node selector, toleration, or PDB settings. The deleted manifest only bound a Se…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only one YAML file and deletes a Kubernetes RoleBinding. The authoritative diff contains no Go or test-binary code and no process-level stdout, logging, or Ginkgo setup …
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only one YAML file and deletes a RoleBinding. It adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	PASS: The pull request only deletes one Kubernetes RoleBinding YAML file. The authoritative diff contains no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret/token comparison c…
Container-Privileges	✅ Passed	The pull request changes one file, and the change deletes a RoleBinding. The patch adds no container or pod security fields such as privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or `…
No-Sensitive-Data-In-Logs	✅ Passed	The pull request changes one file only. It deletes a Kubernetes RoleBinding and adds no logging, credentials, identifiers, hostnames, or customer data. The no-sensitive-data-in-logs check is therefore…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@aliceh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[dustman9000]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aliceh, dustman9000

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dustman9000]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment