From 2a920ab946b4f8770c26fecbac505fdd1a032a7a Mon Sep 17 00:00:00 2001
From: Shubham Pampattiwar <spampatt@redhat.com>
Date: Tue, 18 Aug 2026 10:25:49 -0700
Subject: [PATCH] Add RBAC for secrets/configmaps to datamover controllers

The DataUpload and DataDownload controllers now copy and delete
namespace-scoped secrets/configmaps for backup/restore PVC provisioning.
Add the corresponding kubebuilder RBAC markers (get;list;create;delete
on secrets and configmaps) and regenerate the ClusterRole.

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---
 config/rbac/role.yaml                      | 10 ++++++++++
 pkg/controller/data_download_controller.go |  1 +
 pkg/controller/data_upload_controller.go   |  1 +
 3 files changed, 12 insertions(+)

diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index ea669c709..f8f27a521 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -4,6 +4,16 @@ kind: ClusterRole
 metadata:
   name: velero-perms
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
 - apiGroups:
   - ""
   resources:
diff --git a/pkg/controller/data_download_controller.go b/pkg/controller/data_download_controller.go
index 19d788f3f..1e867fed5 100644
--- a/pkg/controller/data_download_controller.go
+++ b/pkg/controller/data_download_controller.go
@@ -131,6 +131,7 @@ func NewDataDownloadReconciler(
 // +kubebuilder:rbac:groups="",resources=pods,verbs=get
 // +kubebuilder:rbac:groups="",resources=persistentvolumes,verbs=get
 // +kubebuilder:rbac:groups="",resources=persistentvolumerclaims,verbs=get
+// +kubebuilder:rbac:groups="",resources=secrets;configmaps,verbs=get;list;create;delete
 
 func (r *DataDownloadReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	log := r.logger.WithFields(logrus.Fields{
diff --git a/pkg/controller/data_upload_controller.go b/pkg/controller/data_upload_controller.go
index e7eaff956..ae50a7741 100644
--- a/pkg/controller/data_upload_controller.go
+++ b/pkg/controller/data_upload_controller.go
@@ -143,6 +143,7 @@ func NewDataUploadReconciler(
 // +kubebuilder:rbac:groups="",resources=pods,verbs=get
 // +kubebuilder:rbac:groups="",resources=persistentvolumes,verbs=get
 // +kubebuilder:rbac:groups="",resources=persistentvolumerclaims,verbs=get
+// +kubebuilder:rbac:groups="",resources=secrets;configmaps,verbs=get;list;create;delete
 
 func (r *DataUploadReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	log := r.logger.WithFields(logrus.Fields{