helm: grant configmap watch permission to constellation-operator-cont…

[msanft]

…roller-manager

Context

We have an annoying warning in the constellation-operator-controller-manager pod, indicating that it isn't allowed to watch configmaps:

E0203 09:59:44.215148       1 reflector.go:166] "Unhandled Error" err="external/gazelle~~go_deps~io_k8s_client_go/tools/cache/reflector.go:251: Failed to watch
 *v1.ConfigMap: configmaps is forbidden: User \"system:serviceaccount:kube-system:constellation-operator-controller-manager\" cannot watch resource \"configmap
s\" in API group \"\" at the cluster scope" logger="UnhandledError"

Proposed change(s)

• Grant the configmap watch permission to the pod.

Checklist

• Run the E2E tests that are relevant to this PR's changes
• Update docs
• Add labels (e.g., for changelog category)
• Is PR title adequate for changelog?
• Link to Milestone

[netlify]

✅ Deploy Preview for constellation-docs canceled.

Name	Link
🔨 Latest commit	8276e2b
🔍 Latest deploy log	https://app.netlify.com/sites/constellation-docs/deploys/67a11155f716ee00087ec4e0

[burgerdev]

The RBAC config is semi-automatically generated, the source of truth is in kubebuilder comments:

constellation/operators/constellation-node-operator/controllers/nodeversion_controller.go

Line 86 in 76b642b

//+kubebuilder:rbac:groups="",resources=configmaps,verbs=list;get

This is currently not enforced, but I want to canonicalize kubebuilder eventually (cf. #2837). Could you just add watch there for now, too?

[github-actions]

Coverage report

Package	Old	New	Trend
operators/constellation-node-operator/controllers	30.80%	30.80%	🚧