From 2336d54088dc463735390f69ade2241b5aa8eee3 Mon Sep 17 00:00:00 2001 From: k8s-infra-cherrypick-robot <90416843+k8s-infra-cherrypick-robot@users.noreply.github.com> Date: Mon, 29 Sep 2025 10:36:17 -0700 Subject: [PATCH] Fix calico etcd mode networkpolicy RBAC (#12587) Co-authored-by: Chad Swenson --- .../calico/templates/calico-kube-cr.yml.j2 | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2 b/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2 index 27652f0c9..351eea522 100644 --- a/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2 +++ b/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2 @@ -6,19 +6,26 @@ metadata: namespace: kube-system rules: {% if calico_datastore == "etcd" %} - - apiGroups: - - "" - - extensions + # Pods are monitored for changing labels. + # The node controller monitors Kubernetes nodes. + # Namespace and serviceaccount labels are used for policy. + - apiGroups: [""] resources: - pods - - namespaces - - networkpolicies - nodes + - namespaces - serviceaccounts verbs: - watch - list - get + # Watch for changes to Kubernetes NetworkPolicies. + - apiGroups: ["networking.k8s.io"] + resources: + - networkpolicies + verbs: + - watch + - list {% elif calico_datastore == "kdd" %} # Nodes are watched to monitor for deletions. - apiGroups: [""]