From c9e98636f2dfc4507a3a8be0aa2b3daa2e9db61b Mon Sep 17 00:00:00 2001 From: Shaun Crampton Date: Tue, 28 Jul 2026 17:08:19 +0100 Subject: [PATCH] Let kube-controllers watch IPReservations The node controller now watches IPReservation on its syncer to publish the ipam_ippool_reserved metric, so its ClusterRole needs `watch` alongside `list`. Without it the syncer's List still succeeds and the controller still reaches in-sync, but it re-lists IPReservations in a tight loop instead of watching. Pairs with https://github.com/projectcalico/calico/pull/13331, which carries the matching change to the calico chart and static manifests. Co-Authored-By: Claude Opus 5 (1M context) --- pkg/render/kubecontrollers/kube-controllers.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkg/render/kubecontrollers/kube-controllers.go b/pkg/render/kubecontrollers/kube-controllers.go index 8e082f4656..2ec58eb653 100644 --- a/pkg/render/kubecontrollers/kube-controllers.go +++ b/pkg/render/kubecontrollers/kube-controllers.go @@ -435,9 +435,10 @@ func kubeControllersRoleCommonRules(cfg *KubeControllersConfiguration) []rbacv1. }, { // IPAM resources are manipulated in response to node and block updates, as well as periodic triggers. + // The node controller watches IPReservations to report how much of each pool they cover. APIGroups: []string{"projectcalico.org", "crd.projectcalico.org"}, Resources: []string{"ipreservations"}, - Verbs: []string{"list"}, + Verbs: []string{"list", "watch"}, }, { APIGroups: []string{"projectcalico.org", "crd.projectcalico.org"},