Missing cluster permissions in clusterrole

Open Beginner friendly

#8,887 opened on Apr 29, 2026 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 2/5
Estimated time: 1-3 hours
Newbie friendliness: 68/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Quiet
Tech stack: kubernetes
Domain: authorization, devops

Research direction

Start by locating the controller's ClusterRole manifest and compare its rules with the permissions listed under Correction. Reproduce the cross-namespace gateway and EnvoyProxy setup, then verify that TokenReview and SubjectAccessReview calls no longer fail.

Written by the indexing model from the issue text.

Description

stale triage

Description:
"failed to call TokenReview API to verify service acacount jwt"

Repro steps:
create a gateway and envoyproxy in a different namespace to the controller

Environment:
1.7.1

Logs:
See desc.

Correction

- apiGroups:
```
 - authentication.k8s.io
```
resources:
```
 - tokenreviews
```
verbs:
```
 - create
```
- apiGroups:
```
 - authorization.k8s.io
```
resources:
```
 - subjectaccessreviews
```
verbs:
```
 - create
```

Dominant language: Go
Stars: 3k
Forks: 868
Avg merge: 1d 13h
Merged PRs (30d): 124

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

GrafeasNote is a duplicate resource of ContainerAnalysisNote Open

Difficulty 1/5 Under an hour Newbie friendliness 84/100

GoogleCloudPlatform/k8s-config-connector#13349 · Opened Sep 21, 2026
[receiver/receiverhelper] skip WithLinks when the parent span context is invalid Open

enhancement needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

open-telemetry/opentelemetry-collector#15998 · Opened Sep 21, 2026
🧹 Use PodSet wrappers in DRA tests Open

kind/cleanup

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

kubernetes-sigs/kueue#15947 · Opened Sep 21, 2026
Custom provider credential is written as `PROVIDER_API_KEY` (apiserver) but the AgentRun controller injects only allowlisted keys, so every custom provider fails with HTTP 401 Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

sympozium-ai/sympozium#627 · Opened Sep 21, 2026
A recording that opens with an all-zero last_throw emits a zeroed discThrown at frame 0 Open

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

EchoTools/tape#60 · Opened Sep 21, 2026

More Go issues