mirror of
https://github.com/YuzuZensai/netbird-kubernetes-operator.git
synced 2026-09-13 10:49:15 +00:00
GideonandGitHub
38affd24c5
## Problem The `netbird-operator-config` ClusterRole only grants `get` on `nbroutingpeers`, but the `kubernetes-service-expose` job uses a reflector/informer internally which requires both `list` and `watch` to establish a watch stream. This results in the following error at runtime: ``` E0218 16:28:42.344838 1 reflector.go:204] "Failed to watch" err="failed to list *unstructured.Unstructured: nbroutingpeers.netbird.io \"router\" is forbidden: User \"system:serviceaccount:netbird:netbird-operator-config\" cannot list resource \"nbroutingpeers\" in API group \"netbird.io\" in the namespace \"netbird\"" ``` I noticed this error when I enabled the `kubernetesAPI.enabled` flag in the netbird-oberator-config helm chart. ## Fix Add `list` and `watch` verbs to the `nbroutingpeers` rule in the ClusterRole, consistent with how other `netbird.io` resources are already granted in the same role. ## Related Similar issue was reported previously in #24 for a different service account.
48 lines
1004 B
YAML
48 lines
1004 B
YAML
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ include "netbird-operator-config.fullname" . }}
|
|
labels:
|
|
{{- include "netbird-operator-config.labels" . | nindent 4 }}
|
|
rules:
|
|
- apiGroups:
|
|
- netbird.io
|
|
resources:
|
|
- nbresources
|
|
verbs:
|
|
- patch
|
|
- update
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- apiGroups:
|
|
- netbird.io
|
|
resources:
|
|
- nbroutingpeers
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- netbird.io
|
|
resources:
|
|
- nbresources/finalizers
|
|
verbs:
|
|
- update
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: {{ include "netbird-operator-config.fullname" . }}
|
|
labels:
|
|
{{- include "netbird-operator-config.labels" . | nindent 4 }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: {{ include "netbird-operator-config.fullname" . }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ include "netbird-operator-config.serviceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|