ITADN

Helm chart ClusterRole missing persistentvolumeclaims permission added in #1752

#1846ClosedMaxAnderson95 创建于 2026-03-03
M
MaxAnderson95commented
After upgrading from chart 0.34.0 to 0.35.0, the descheduler fails with: ``` failed to list *v1.PersistentVolumeClaim: persistentvolumeclaims is forbidden: User "system:serviceaccount:kube-system:descheduler" cannot list resource "persistentvolumeclaims" in API group "" at the cluster scope ``` #1752 added a PVC informer and updated the raw RBAC manifests, but the Helm chart's `clusterrole.yaml` template was not updated. Comparing the two versions confirms the templates are identical: https://github.com/kubernetes-sigs/descheduler/blob/descheduler-helm-chart-0.34.0/charts/descheduler/templates/clusterrole.yaml https://github.com/kubernetes-sigs/descheduler/blob/descheduler-helm-chart-0.35.0/charts/descheduler/templates/clusterrole.yaml The chart's default `values.yaml` also now enables `PodsWithPVC` protection, so this breaks out of the box. The fix should be adding the following rule to `charts/descheduler/templates/clusterrole.yaml`: ```yaml - apiGroups: [""] resources: ["persistentvolumeclaims"] verbs: ["get", "watch", "list"] ```
关闭于 2026-03-03 1 条评论