Grant list permissions for Pods and events [ONPREM-1643] (#66)

* Grant list permissions for Pods and events

* Add changelog entry and bump version for release

* Update README

Chart.yaml

@@ -4,6 +4,6 @@ description: For deploying a CircleCI Container Agent
 icon: https://raw.githubusercontent.com/circleci/media/master/logo/build/horizontal_dark.1.png
 type: application
 
-version: "101.1.1"
+version: "101.1.2"
 appVersion: "3"
 kubeVersion: ">= 1.25-0"

README.md

@@ -2,7 +2,7 @@
 
 For deploying a CircleCI Container Agent
 
-![Version: 101.1.1](https://img.shields.io/badge/Version-101.1.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3](https://img.shields.io/badge/AppVersion-3-informational?style=flat-square)
+![Version: 101.1.2](https://img.shields.io/badge/Version-101.1.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3](https://img.shields.io/badge/AppVersion-3-informational?style=flat-square)
 
 ## Support
 

changelog.md

@@ -2,6 +2,9 @@
 
 # Edge
 
+# 101.1.2
+
+[#66](https://github.com/CircleCI-Public/container-runner-helm-chart/pull/66) Grant role list permissions for Pods and events. This change supports the migration to Kubernetes informers, which require listing resources on startup and during resync operations.
 [#64](https://github.com/CircleCI-Public/container-runner-helm-chart/pull/64) Start signing the Helm chart to ensure provenance: https://helm.sh/docs/topics/provenance/
 [#59](https://github.com/CircleCI-Public/container-runner-helm-chart/pull/59) Fix service container config example & update test
 

templates/role.yaml

@@ -18,7 +18,7 @@ rules:
     verbs: ["get", "list", "create", "delete"]
   - apiGroups: ["", "events.k8s.io/v1"]
     resources: ["events"]
-    verbs: ["watch"]
+    verbs: ["watch", "list"]
 
   {{- if .Values.agent.ssh.enabled }}
   - apiGroups: ["", "gateway.networking.k8s.io"]
@@ -58,7 +58,7 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: ["pods"]
-    verbs: ["watch"]
+    verbs: ["watch", "list"]
   - apiGroups: [""]
     resources: ["pods/log"]
     verbs: ["get"]

tests/roles_test.yaml

@@ -25,7 +25,7 @@ tests:
               verbs: ["get", "list", "create", "delete"]
             - apiGroups: ["", "events.k8s.io/v1"]
               resources: ["events"]
-              verbs: ["watch"]
+              verbs: ["watch", "list"]
             - apiGroups: [""]
               resources: ["configmaps"]
               verbs: ["get"]
@@ -35,7 +35,7 @@ tests:
           value:
             - apiGroups: [""]
               resources: ["pods"]
-              verbs: ["watch"]
+              verbs: ["watch", "list"]
             - apiGroups: [""]
               resources: ["pods/log"]
               verbs: ["get"]