From 38affd24c5b48d1129d76da8e07debaa9fe08076 Mon Sep 17 00:00:00 2001 From: Gideon Date: Tue, 3 Mar 2026 00:32:41 -0700 Subject: [PATCH] fix: add list and watch verbs for nbroutingpeers in ClusterRole (#107) ## Problem The `netbird-operator-config` ClusterRole only grants `get` on `nbroutingpeers`, but the `kubernetes-service-expose` job uses a reflector/informer internally which requires both `list` and `watch` to establish a watch stream. This results in the following error at runtime: ``` E0218 16:28:42.344838 1 reflector.go:204] "Failed to watch" err="failed to list *unstructured.Unstructured: nbroutingpeers.netbird.io \"router\" is forbidden: User \"system:serviceaccount:netbird:netbird-operator-config\" cannot list resource \"nbroutingpeers\" in API group \"netbird.io\" in the namespace \"netbird\"" ``` I noticed this error when I enabled the `kubernetesAPI.enabled` flag in the netbird-oberator-config helm chart. ## Fix Add `list` and `watch` verbs to the `nbroutingpeers` rule in the ClusterRole, consistent with how other `netbird.io` resources are already granted in the same role. ## Related Similar issue was reported previously in #24 for a different service account. --- helm/netbird-operator-config/templates/rbac.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/helm/netbird-operator-config/templates/rbac.yaml b/helm/netbird-operator-config/templates/rbac.yaml index 56f2ea6..eae4ee5 100644 --- a/helm/netbird-operator-config/templates/rbac.yaml +++ b/helm/netbird-operator-config/templates/rbac.yaml @@ -22,6 +22,8 @@ rules: - nbroutingpeers verbs: - get + - list + - watch - apiGroups: - netbird.io resources: