fix computedomain daemon permissions in openshift

[rahulait]

Description

Fixes #3010

Checklist

• No secrets, sensitive information, or unrelated changes
• Lint checks passing (make lint)
• Generated assets in-sync (make validate-generated-assets)
• Go mod artifacts in-sync (make validate-modules)
• Test cases are added for new code paths

Testing

---

[rahulait]

/cherry-pick release-26.7

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (1)

AGENTS.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: NVIDIA/gpu-operator/.coderabbit.yaml
• Review profile: QUIET
• Plan: Enterprise
• Run ID: ef978128-8239-435d-862e-251db618e5e7

📥 Commits

Reviewing files that changed from the base of the PR and between f1f7ff4 and f4aa102.

⛔ Files ignored due to path filters (1)

• internal/state/testdata/golden/gpucluster-dra-driver-full-spec.yaml is excluded by !**/testdata/**

📒 Files selected for processing (6)

• bundle/manifests/gpu-operator-certified.clusterserviceversion.yaml
• deployments/gpu-operator/templates/clusterrole.yaml
• internal/state/dra_driver_test.go
• internal/state/gpucluster_scc_test.go
• manifests/state-dra-driver/0120_compute-domain-daemon-rbac.yaml
• manifests/state-dra-driver/0450_scc.openshift.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The changes add delete permission for computedomaincliques to three RBAC declarations. The OpenShift SCC priority changes from null to 10. Tests check the daemon ClusterRole permissions and the SCC service account, priority, and run-as-user strategy.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to f4aa1

No actionable issue is identified that would prevent merging after normal checks.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[tariq1890]

I presume this change is needed to address scenarios where the OwnerReferencesPermissionEnforcement admissions controller is enabled?

Are there other areas in our RBAC which would need a similar change?

[rahulait]

I presume this change is needed to address scenarios where the OwnerReferencesPermissionEnforcement admissions controller is enabled?

Correct, openshift has this admission plugin enabled by default: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/architecture/admission-plug-ins

Are there other areas in our RBAC which would need a similar change?

I don't think so, tried analyzing the code and no other recommendation was suggested where such permissions are missing.

[shivamerla]

Usage of anyuid SCC aligns with the DRA helm chart deployment. The fix looks good to me.

[github-actions]

🤖 Backport PR created for release-26.7: #3022 ✅