Helm chart ClusterRole missing persistentvolumeclaims permission added in #1752
After upgrading from chart 0.34.0 to 0.35.0, the descheduler fails with:
```
failed to list *v1.PersistentVolumeClaim: persistentvolumeclaims is forbidden: User "system:serviceaccount:kube-system:descheduler" cannot list resource "persistentvolumeclaims" in API group "" at the cluster scope
```
#1752 added a PVC informer and updated the raw RBAC manifests, but the Helm chart's `clusterrole.yaml` template was not updated. Comparing the two versions confirms the templates are identical:
https://github.com/kubernetes-sigs/descheduler/blob/descheduler-helm-chart-0.34.0/charts/descheduler/templates/clusterrole.yaml
https://github.com/kubernetes-sigs/descheduler/blob/descheduler-helm-chart-0.35.0/charts/descheduler/templates/clusterrole.yaml
The chart's default `values.yaml` also now enables `PodsWithPVC` protection, so this breaks out of the box.
The fix should be adding the following rule to `charts/descheduler/templates/clusterrole.yaml`:
```yaml
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "watch", "list"]
```
关闭于 2026-03-03 1 条评论