fix: add list and watch verbs for nbroutingpeers in ClusterRole (#107)

## Problem

The `netbird-operator-config` ClusterRole only grants `get` on
`nbroutingpeers`, but the `kubernetes-service-expose` job uses a
reflector/informer internally which requires both `list` and `watch` to
establish a watch stream. This results in the following error at
runtime:

```
E0218 16:28:42.344838       1 reflector.go:204] "Failed to watch" err="failed to list *unstructured.Unstructured: nbroutingpeers.netbird.io \"router\" is forbidden: User \"system:serviceaccount:netbird:netbird-operator-config\" cannot list resource \"nbroutingpeers\" in API group \"netbird.io\" in the namespace \"netbird\""
```

I noticed this error when I enabled the `kubernetesAPI.enabled` flag in
the netbird-oberator-config helm chart.

## Fix

Add `list` and `watch` verbs to the `nbroutingpeers` rule in the
ClusterRole, consistent with how other `netbird.io` resources are
already granted in the same role.

## Related

Similar issue was reported previously in #24 for a different service
account.
This commit is contained in:
Gideon
2026-03-03 08:32:41 +01:00
committed by GitHub
parent f6765c1cf4
commit 38affd24c5
@@ -22,6 +22,8 @@ rules:
- nbroutingpeers
verbs:
- get
- list
- watch
- apiGroups:
- netbird.io
resources: