epostnikof/kubespray
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2025-12-13 21:34:40 +03:00
Code Issues Packages Projects Releases Wiki Activity

Update Calico apiserver RBAC for Kubernetes 1.33+ (#12654)

Browse Source 
Add missing RBAC permissions for Calico apiserver to function correctly
with Kubernetes 1.33+

Changes:

1. Add K8s 1.33 ValidatingAdmissionPolicy resources to calico-webhook-reader
   - validatingadmissionpolicies
   - validatingadmissionpolicybindings

Kubernetes 1.33 introduced ValidatingAdmissionPolicy resources (KEP-3488)
that require explicit RBAC permissions. Without these changes, Calico
apiserver on k8s 1.33+ will not work and needless errors are logged
This commit is contained in:
Chris Ricker
2025-11-14 03:23:38 -05:00
committed by GitHub
parent 2d179879a0
commit 47140083dc
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
roles/network_plugin/calico/templates/calico-apiserver.yml.j2
View File

@@ -235,6 +235,8 @@ rules:
resources: resources:
- mutatingwebhookconfigurations - mutatingwebhookconfigurations
- validatingwebhookconfigurations - validatingwebhookconfigurations
- validatingadmissionpolicies # Required for Kubernetes 1.33+
- validatingadmissionpolicybindings # Required for Kubernetes 1.33+
verbs: verbs:
- get - get
- list - list