Classifier v1.12.0 migration fails: classifier-manager RBAC lacks namespaces get

[nilpntr]

The upgrade migration added in v1.12.0 needs get on namespaces, but the classifier controller RBAC (config/rbac/role.yaml, mirrored into the helm chart) does not grant it. The migrate initContainer crash-loops and classifier-manager never becomes Ready.

Where

migration.go Gets the namespace of each matching cluster:

return fmt.Errorf("checking namespace %s: %w", d.ref.Namespace, err)

This runs for e.g. a management-cluster SveltosCluster registered in its own namespace (agent.managementCluster=true).

Symptom

main.go:291] "migration failed" err="migrating classifier default-classifier:
checking namespace <ns>: namespaces \"<ns>\" is forbidden:
User \"system:serviceaccount:projectsveltos:classifier-manager\" cannot get
resource \"namespaces\" in API group \"\" in the namespace \"<ns>\""

classifier-manager Deployment then reports ProgressDeadlineExceeded; any Argo/Flux app wrapping it stays Degraded.

Root cause

classifier-manager-role grants no namespaces verb. It needs, on the core ("") group:

resources: [namespaces], verbs: [get, list, watch]

Fix

Add the kubebuilder RBAC marker where the migration/reconciler reads namespaces so it propagates to config/rbac/role.yaml on make manifests:

// +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list;watch

I opened a chart-side stopgap so consumers are unblocked now: projectsveltos/helm-charts#199 — but it will be re-dropped on the next chart regen unless the marker lands here.

Repro

Install chart 1.12.1 with agent.managementCluster=true, let the mgmt SveltosCluster register, observe the classifier-manager migrate initContainer crash-loop.

[gianlucam76]

Thank you so much @nilpntr for reporting this. I missed it as I only test upgrade from previous release (in this case v1.11.1) to new one (v1.12.0)

I pushed this to helm chart projectsveltos/helm-charts#200 temporarily granting classifier get/list/watch permissions on namespaces. Those permissions will be removed in next release as the main fix is in classifier itself (#486). Classifier does not need to check whether namespace exists (so requiring extra permissions) it can check whether cluster exists (classifier already has those permissions),

Please let me know if with the extra rbac, the upgrade works.

Thank you so much again

[gianlucam76]

@nilpntr I am terribly sorry I missed you had a PR already on the helm-chart. I reverted my PR in the helm-charts repo and merged yours (thank you for contributing to it).

[nilpntr]

No problem @gianlucam76 thanks for the fast fix and for the amazing work you guys are doing with sveltos!