kubevirt-datamover ClusterRole missing RBAC for Phase 3 (DataDownload) support #2351

Problem

The ClusterRole bound to oadp-kubevirt-datamover-controller-manager (oadp-operator.v99.0.0-... on test clusters) is missing rules that kubevirt-datamover-controller's manager needs. Without them, the controller-runtime cache's watch on DataDownload fails continuously:

datadownloads.velero.io is forbidden: ... cannot list resource "datadownloads" ... at the cluster scope

This stalls the entire manager's reconcile loop — not just DataDownload, but DataUpload too, since they share one cache/manager process.

Root cause

DataDownload support (Phase 3 of kubevirt-datamover-controller issue #73) is still in an open PR (migtools/kubevirt-datamover-controller#124) and hasn't merged into oadp-dev yet, so config/kubevirt-datamover-controller_rbac/role.yaml (and the bundle CSV generated from it) is working from a pre-Phase-3 copy.

Exact rules missing

Source of truth: config/rbac/role.yaml in kaovilai/kubevirt-datamover-controller branch issue-73-phase3-datadownload-controller (PR #124), which will land in migtools/kubevirt-datamover-controller's oadp-dev-tracking branch once merged:

- apiGroups:
  - velero.io
  resources:
  - datadownloads
  verbs:
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - velero.io
  resources:
  - datadownloads/status
  verbs:
  - get
  - patch
  - update

Confirmed via diff against the live ClusterRole and upstream role.yaml: everything else (persistentvolumeclaims, persistentvolumes, pods, pods/log, secrets, backup.kubevirt.io/virtualmachinebackups[/trackers], kubevirt.io/virtualmachines, velero.io/backupstoragelocations, velero.io/datauploads[/status]) already matches current role.yaml exactly. datadownloads/datadownloads/status are the only gaps (upstream merges them into the same rule blocks as datauploads/datauploads/status).

Ask

Update config/kubevirt-datamover-controller_rbac/role.yaml (and regenerate the bundle CSV via make bundle) to include these rule blocks for the kubevirt-datamover component. Once #124 merges upstream, re-syncing against oadp-dev's config/rbac/role.yaml via make update-kubevirt-datamover-manifests will pick this up automatically going forward.

How to verify the fix

Deploy, then:

oc logs deployment/oadp-kubevirt-datamover-controller-manager -n openshift-adp

should show no Failed to watch ... datadownloads errors, and a DataUpload created via a real velero backup should actually progress past an empty status.phase (currently wedged there because of this).