Merge pull request #66717 from wolfi-dev/cve-custom-pod-autoscaler-operator-1.4.2-r1-1fac07368670f1e68a5796b87f50224d

custom-pod-autoscaler-operator/1.4.2-r1: cve remediation

Author: efbar

custom-pod-autoscaler-operator.yaml

@@ -1,7 +1,7 @@
 package:
   name: custom-pod-autoscaler-operator
   version: "1.4.2"
-  epoch: 1
+  epoch: 2 # CVE-2025-47906
   description: Operator for managing Kubernetes Custom Pod Autoscalers (CPA).
   copyright:
     - license: Apache-2.0
@@ -73,7 +73,72 @@ test:
       uses: test/daemon-check-output
       with:
         setup: |
-          helm install custom-pod-autoscaler-operator https://github.com/jthomperoo/custom-pod-autoscaler-operator/releases/download/v${{package.version}}/custom-pod-autoscaler-operator-v${{package.version}}.tgz
+          # Fix permissions
+          kubectl apply -f - <<'EOF'
+          apiVersion: rbac.authorization.k8s.io/v1
+          kind: ClusterRole
+          metadata:
+            name: cpa-operator
+          rules:
+            # Manage CPA CRs
+            - apiGroups: ["custompodautoscaler.com"]
+              resources: ["custompodautoscalers"]
+              verbs: ["get", "list", "watch"]
+            - apiGroups: ["custompodautoscaler.com"]
+              resources: ["custompodautoscalers/status", "custompodautoscalers/finalizers"]
+              verbs: ["get", "update", "patch"]
+
+            # Core objects the operator reads/creates
+            - apiGroups: [""]
+              resources: ["pods", "serviceaccounts", "secrets", "configmaps", "events"]
+              verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+
+            # Workload APIs it may manage for runners
+            - apiGroups: ["apps"]
+              resources: ["deployments", "replicasets", "statefulsets"]
+              verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+            - apiGroups: ["apps"]
+              resources: ["deployments/scale", "replicasets/scale", "statefulsets/scale"]
+              verbs: ["get", "update", "patch"]
+            - apiGroups: [""]
+              resources: ["replicationcontrollers"]
+              verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+            - apiGroups: [""]
+              resources: ["replicationcontrollers/scale"]
+              verbs: ["get", "update", "patch"]
+
+            # RBAC: allow creating roles/bindings AND granting perms (escalate/bind)
+            - apiGroups: ["rbac.authorization.k8s.io"]
+              resources: ["roles", "rolebindings"]
+              verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "escalate", "bind"]
+            # Often helpful so it can bind existing ClusterRoles if needed
+            - apiGroups: ["rbac.authorization.k8s.io"]
+              resources: ["clusterroles", "clusterrolebindings"]
+              verbs: ["get", "list", "watch", "bind"]
+          ---
+          apiVersion: rbac.authorization.k8s.io/v1
+          kind: ClusterRoleBinding
+          metadata:
+            name: cpa-operator
+          roleRef:
+            apiGroup: rbac.authorization.k8s.io
+            kind: ClusterRole
+            name: cpa-operator
+          subjects:
+            - kind: ServiceAccount
+              name: cpa
+              namespace: default
+          EOF
+          helm show crds https://github.com/jthomperoo/custom-pod-autoscaler-operator/releases/download/v${{package.version}}/custom-pod-autoscaler-operator-v${{package.version}}.tgz \
+            | kubectl apply --server-side -f -
+          kubectl wait --for=condition=Established crd/custompodautoscalers.custompodautoscaler.com --timeout=60s
+          helm install custom-pod-autoscaler-operator \
+            https://github.com/jthomperoo/custom-pod-autoscaler-operator/releases/download/v${{package.version}}/custom-pod-autoscaler-operator-v${{package.version}}.tgz \
+            -n default --create-namespace \
+            --set serviceAccount.create=false \
+            --set serviceAccount.name=cpa \
+            --set rbac.create=false \
+            --wait
         start: "/operator"
         timeout: 10
         expected_output: |