From aae6fe298fe2adac440f69aa86521633fac81503 Mon Sep 17 00:00:00 2001 From: Xavier Lange Date: Wed, 1 Jul 2026 23:04:53 -0400 Subject: [PATCH] fix: grant RBAC for events.k8s.io Events emitted by the events/v1 recorder The recorder returned by mgr.GetEventRecorder writes events.k8s.io/v1 Events, but role.yaml only granted events verbs in the core ("") API group, so the API server rejects every operator-emitted Event on real clusters (envtest does not enforce RBAC): Server rejected event (will not retry!) ... cannot create resource "events" in API group "events.k8s.io" Add an events.k8s.io events create;patch RBAC marker (the two verbs the client-go tools/events broadcaster uses) and regenerate role.yaml. Signed-off-by: Xavier Lange --- config/rbac/role.yaml | 7 +++++++ internal/controller/etcdcluster_controller.go | 1 + 2 files changed, 8 insertions(+) diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 6c9ac65e..d54a941f 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -61,6 +61,13 @@ rules: - get - list - watch +- apiGroups: + - events.k8s.io + resources: + - events + verbs: + - create + - patch - apiGroups: - operator.etcd.io resources: diff --git a/internal/controller/etcdcluster_controller.go b/internal/controller/etcdcluster_controller.go index 867886a3..67ba662f 100644 --- a/internal/controller/etcdcluster_controller.go +++ b/internal/controller/etcdcluster_controller.go @@ -69,6 +69,7 @@ type reconcileState struct { // +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups="",resources=events,verbs=create;patch;get;list;update +// +kubebuilder:rbac:groups=events.k8s.io,resources=events,verbs=create;patch // +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;patch;update;delete // +kubebuilder:rbac:groups="cert-manager.io",resources=certificates,verbs=get;list;watch;create;patch;update;delete // +kubebuilder:rbac:groups="cert-manager.io",resources=clusterissuers,verbs=get;list;watch