Add mutating admission policy RBAC to apiserver role

[lukasfrank]

Proposed Changes

• Add mutatingadmissionpolicies and mutatingadmissionpolicybindings (get/list/watch) to the apiserver-role ClusterRole.
• As of Kubernetes 1.36, MutatingAdmissionPolicy/MutatingAdmissionPolicyBinding are served as GA (admissionregistration.k8s.io/v1). The aggregated apiserver's admission
  informers now watch them; without the RBAC grant the informers hit forbidden errors and never sync, so the informer-sync readyz check fails and the apiserver pod never becomes
  Ready.

Summary by CodeRabbit

• Bug Fixes
  • Improved admission policy management by enabling the system to read and monitor mutating admission policies and their bindings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 54d3eb8b-c6f9-4cbe-9f25-901651bf2c5c

📥 Commits

Reviewing files that changed from the base of the PR and between 8c9925a and f3847cf.

📒 Files selected for processing (1)

• config/apiserver/rbac/apiserver_role.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The apiserver ClusterRole now grants get, list, and watch access to mutatingadmissionpolicies and mutatingadmissionpolicybindings.

Changes

Admission policy RBAC

Layer / File(s)	Summary
Extend apiserver admission permissions config/apiserver/rbac/apiserver_role.yaml	The existing admissionregistration.k8s.io rule now includes mutatingadmissionpolicies and mutatingadmissionpolicybindings for get, list, and watch access.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to f3847

This localized RBAC change grants the apiserver read access to the required mutating admission policy resources; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: adracus

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: adding mutating admission policy RBAC permissions to the apiserver role.
Description check	✅ Passed	The description uses the Proposed Changes section, identifies the exact resources and permissions, and explains the Kubernetes 1.36 readiness impact. The optional issue reference is not provided, but …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description uses the Proposed Changes section, identifies the exact resources and permissions, and explains the Kubernetes 1.36 readiness impact. The optional issue reference is not provided, but the description is otherwise complete and relevant.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}