Fix module reconciler not being able to watch for ConfigMaps error (#179

) This fix adds the watch permission for ConfigMaps to the Module reconciler, in order to be able to successfully client.Get() the build Dockerfile ConfigMap. This client.Get() fails because the contoller-runtime client reads from its cache, instead of directly from the API server. The client needs the watch permission, in order to be able to build its cache. - kubernetes-sigs/controller-runtime#1156 Signed-off-by: Michail Resvanis <mresvani@redhat.com> Signed-off-by: Michail Resvanis <mresvani@redhat.com>
kubernetes-sigs · Dec 2, 2022 · dedee81 · dedee81
1 parent 9401c98
commit dedee81
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -54,6 +54,7 @@ rules:
   verbs:
   - get
   - list
+  - watch
 - apiGroups:
   - ""
   resources:

diff --git a/controllers/module_reconciler.go b/controllers/module_reconciler.go
@@ -90,7 +90,7 @@ func NewModuleReconciler(
 //+kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=create;delete;get;list;patch;watch
 //+kubebuilder:rbac:groups="core",resources=nodes,verbs=get;list;watch
 //+kubebuilder:rbac:groups="core",resources=secrets,verbs=get;list;watch
-//+kubebuilder:rbac:groups="core",resources=configmaps,verbs=get;list
+//+kubebuilder:rbac:groups="core",resources=configmaps,verbs=get;list;watch
 //+kubebuilder:rbac:groups="core",resources=serviceaccounts,verbs=create;delete;get;list;patch;watch
 //+kubebuilder:rbac:groups="batch",resources=jobs,verbs=create;list;watch;delete