cluster

commit dd3734a32254f891a0370a8fa87960de44b76a29
parent 150df983e26c8cd40a3910e8def9e5cb97262720
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Sat, 28 Feb 2026 12:30:59 +0100

fix rbac issues properly

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
infrastructure_talos/controllers/descheduler.yaml
 | 
29
++++++++++++++++++++++++-----

1 file changed, 24 insertions(+), 5 deletions(-)
diff --git a/infrastructure_talos/controllers/descheduler.yaml b/infrastructure_talos/controllers/descheduler.yaml
@@ -29,11 +29,6 @@ spec:
         namespace: descheduler
       interval: 12h
   values:
-    rbac:
-      additionalRules:
-        - apiGroups: [""]
-          resources: ["persistentvolumeclaims"]
-          verbs: ["get", "list", "watch"]
     tolerations:
       - key: "arch"
         operator: "Equal"
@@ -99,3 +94,27 @@ spec:
                 - RemovePodsViolatingNodeTaints
                 - RemovePodsViolatingNodeAffinity
                 - RemovePodsViolatingInterPodAntiAffinity
+---
+# The descheduler chart (v0.35.0) does not include PVC list/watch in its
+# default ClusterRole, but it's required for ignorePvcPods: true.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: descheduler-pvc-reader
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: descheduler-pvc-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: descheduler-pvc-reader
+subjects:
+  - kind: ServiceAccount
+    name: descheduler
+    namespace: descheduler