From bb4d23506fec9250ac1a68b41bd30385ed6944b0 Mon Sep 17 00:00:00 2001 From: Hai Huang Date: Sat, 6 Jun 2026 11:24:42 -0400 Subject: [PATCH] fix(chart): grant cert-manager certificates RBAC to the operator ClusterRole MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Helm chart's hand-maintained ClusterRole (charts/kagenti-operator/ templates/rbac/role.yaml) drifted from the kubebuilder-generated config/rbac/role.yaml: it was missing the cert-manager.io/certificates + clusterissuers get/list/watch rules. PR #383 (SharedTrust controller) added a Watches(&cmv1.Certificate{}) informer and the corresponding +kubebuilder:rbac marker, and regenerated config/rbac/role.yaml — but did not update the chart's separate ClusterRole. Since installs render RBAC from the chart, the deployed operator's ServiceAccount cannot list/watch cert-manager Certificates. The Certificate informer never syncs, the manager misses its cache-sync deadline and exits 1 (~2.5 min crashloop), so NO controllers run — including ClientRegistrationReconciler. Agents' per-agent Keycloak client-credentials secrets are therefore never created, and agent pods hang on FailedMount (observed on weather-agent; matches a user report on a fresh main install). Add the cert-manager.io rules to the chart role to match the generated role. Follow-up (not in this PR): the chart ClusterRole is maintained separately from config/rbac/role.yaml with no sync, so any future RBAC marker can silently drift again. Worth generating the chart role from the kubebuilder role or adding a CI drift check. Assisted-By: Claude (Anthropic AI) Signed-off-by: Hai Huang --- charts/kagenti-operator/templates/rbac/role.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/charts/kagenti-operator/templates/rbac/role.yaml b/charts/kagenti-operator/templates/rbac/role.yaml index 0406a538..c4445640 100755 --- a/charts/kagenti-operator/templates/rbac/role.yaml +++ b/charts/kagenti-operator/templates/rbac/role.yaml @@ -62,6 +62,15 @@ rules: - create - get - update +- apiGroups: + - cert-manager.io + resources: + - certificates + - clusterissuers + verbs: + - get + - list + - watch - apiGroups: - agent.kagenti.dev resources: