From 2d8f15f95a6fb6b216a0a6b3aeb8478df0d7cf9d Mon Sep 17 00:00:00 2001
From: Toshihiko Kimura <t-kimura@sakura.ad.jp>
Date: Sat, 18 Jul 2026 00:19:30 +0900
Subject: [PATCH] fix(calico): Add missing permissions in RBAC for
 calico-kube-controllers (#13375)

* fix(calico): Add namespace rbac for calico-kube-controllers

* fix(calico): Add missing RBAC resource for calico-kube-controllers
---
 .../calico/templates/calico-kube-cr.yml.j2               | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2 b/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2
index c46ba68d5..8bfef3d84 100644
--- a/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2
+++ b/roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2
@@ -71,6 +71,7 @@ rules:
       - blockaffinities
       - ipamblocks
       - ipamhandles
+      - ipamconfigs
       - tiers
     verbs:
       - get
@@ -124,4 +125,12 @@ rules:
       - list
       - update
       - watch
+  # Namespaces are watched for LoadBalancer IP allocation with namespace selector support
+  - apiGroups: [""]
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
 {% endif %}