controller-manager can't access RemoteCluster due to namespaced role

[miedzinski]

controller-manager can't access RemoteCluster due to namespaced role

[STRRL]

Hi @miedzinski , It's better to create another role and cluster role biding for the CRD RemoteCluster.

Could you help us to improve it?

[miedzinski]

You're right. There is a ClusterRole for that

chaos-mesh/helm/chaos-mesh/templates/controller-manager-rbac.yaml

Lines 70 to 91 in 6411f53

	kind: ClusterRole
	apiVersion: rbac.authorization.k8s.io/v1
	metadata:
	name: {{ .Release.Name }}-chaos-controller-manager-cluster-level
	labels:
	{{- include "chaos-mesh.labels" . | nindent 4 }}
	app.kubernetes.io/component: controller-manager
	rules:
	- apiGroups: [ "" ]
	resources:
	- nodes
	- persistentvolumes
	- persistentvolumeclaims
	{{- if .Values.clusterScoped }}
	- namespaces
	- services
	{{- end }}
	verbs: [ "get", "list", "watch" ]
	- apiGroups: [ "authorization.k8s.io" ]
	resources:
	- subjectaccessreviews
	verbs: [ "create" ]

so it could be added there. Submitted #4419.