Grant RBAC for events in events.k8s.io API group

[friegger]

Recent k8s.io/* and controller-runtime versions wire up the new EventRecorder which writes to events.k8s.io/v1. Without this rule the apiserver rejects every event with:

events.events.k8s.io "..." is forbidden: ... cannot patch
resource "events" in API group "events.k8s.io"

Contributes to #1489

Summary by CodeRabbit

• Bug Fixes
  • Updated event permissions to use the standard Kubernetes events API group, improving compatibility for event creation and updates.
  • Adjusted several access rules so related components have consistent permissions for secrets and events.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c992bfde-f920-46c7-a7f8-9265ef6bf171

📥 Commits

Reviewing files that changed from the base of the PR and between e06df4e and 44ef511.

📒 Files selected for processing (15)

• config/apiserver/rbac/bucketpool_role.yaml
• config/apiserver/rbac/machinepool_role.yaml
• config/apiserver/rbac/volumepool_role.yaml
• config/bucketpoollet-broker/poollet-rbac/role.yaml
• config/controller/rbac/role.yaml
• config/machinepoollet-broker/poollet-rbac/role.yaml
• config/volumepoollet-broker/poollet-rbac/role.yaml
• internal/controllers/compute/machine_scheduler.go
• internal/controllers/ipam/prefixallocationscheduler_controller.go
• internal/controllers/storage/bucket_scheduler.go
• internal/controllers/storage/volume_scheduler.go
• poollet/bucketpoollet/controllers/bucket_controller.go
• poollet/machinepoollet/controllers/machine_controller.go
• poollet/volumepoollet/controllers/volume_controller.go
• poollet/volumepoollet/controllers/volumesnapshot_controller.go

---

📝 Walkthrough

Walkthrough

RBAC rules for the events resource are updated across kubebuilder markers in Go controller files and YAML ClusterRole manifests to include events.k8s.io in apiGroups alongside the core empty group. Some YAML files also reorder the secrets rule to appear before the events rule.

Changes

events.k8s.io RBAC group extension

Layer / File(s)	Summary
Kubebuilder RBAC markers in Go controllers internal/controllers/compute/machine_scheduler.go, internal/controllers/ipam/prefixallocationscheduler_controller.go, internal/controllers/storage/bucket_scheduler.go, internal/controllers/storage/volume_scheduler.go, poollet/bucketpoollet/controllers/bucket_controller.go, poollet/machinepoollet/controllers/machine_controller.go, poollet/volumepoollet/controllers/volume_controller.go, poollet/volumepoollet/controllers/volumesnapshot_controller.go	+kubebuilder:rbac markers for events are updated from groups="" to groups=events.k8s.io across all controller and scheduler files; verbs remain create;patch.
YAML ClusterRole manifests config/apiserver/rbac/bucketpool_role.yaml, config/apiserver/rbac/machinepool_role.yaml, config/apiserver/rbac/volumepool_role.yaml, config/bucketpoollet-broker/poollet-rbac/role.yaml, config/controller/rbac/role.yaml, config/machinepoollet-broker/poollet-rbac/role.yaml, config/volumepoollet-broker/poollet-rbac/role.yaml	apiGroups for the events resource rule is extended to include both "" and events.k8s.io in each ClusterRole; some files also reorder the secrets rule entry to precede the events rule.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the motivation, but it does not follow the required template and is missing the Proposed Changes bullets and Fixes # line.	Add the required Proposed Changes section with bullets and include a proper Fixes #1489 line to match the repository template.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely matches the main change: granting RBAC for events in the events.k8s.io API group.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1489-add-new-required-rbac

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}