From ccd869c8bb0ff203102e8d77364db8f17dcd401b Mon Sep 17 00:00:00 2001 From: Praise Wenegieme Date: Fri, 3 Jul 2026 15:29:38 +0100 Subject: [PATCH] feat(observability): grant Target Allocator CRD watch RBAC Grant the Target Allocator get;list;watch on customresourcedefinitions (apiextensions.k8s.io), scoped under the existing prometheus-CR RBAC gate. The Target Allocator now watches the ServiceMonitor/PodMonitor CustomResourceDefinitions so it can start or stop each monitor informer as the CRD appears or disappears, letting it run healthily regardless of whether the CRDs are installed yet. That CRD watch requires this read-only, cluster-scoped grant; without it the informer is denied with Forbidden. Companion to the operator-side change "target-allocator: tolerate missing ServiceMonitor/PodMonitor CRDs". --- .../templates/target-allocator-clusterrole.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/charts/amazon-cloudwatch-observability/templates/target-allocator-clusterrole.yaml b/charts/amazon-cloudwatch-observability/templates/target-allocator-clusterrole.yaml index 951e6e4e..55aa1748 100644 --- a/charts/amazon-cloudwatch-observability/templates/target-allocator-clusterrole.yaml +++ b/charts/amazon-cloudwatch-observability/templates/target-allocator-clusterrole.yaml @@ -26,6 +26,12 @@ rules: - apiGroups: [ "monitoring.coreos.com"] resources: ["podmonitors", "servicemonitors"] verbs: ["get", "list", "watch"] + # The Target Allocator watches the ServiceMonitor/PodMonitor CustomResourceDefinitions + # so it can start/stop each informer as the CRD appears or disappears, letting it + # run healthily regardless of whether the CRDs are installed (read-only, cluster-scoped). + - apiGroups: [ "apiextensions.k8s.io" ] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "watch"] {{- end }} {{- end }} ---