From 61c08bf7f0c1b1a768311f61bc6fce58c6bcc355 Mon Sep 17 00:00:00 2001
From: Oleksii Kurinnyi <okurinny@redhat.com>
Date: Wed, 18 Mar 2026 16:07:48 +0200
Subject: [PATCH] fix: grant dashboard SA read access to
 DevWorkspaceOperatorConfig

The dashboard backup feature needs to read the DWOC to get backup
configuration (schedule, registry path, auth secret name). Without
this permission, the dashboard SA gets 403 Forbidden when reading
the DWOC in the DWO namespace, causing backup endpoints to fail
for all users.

Assisted-by: Claude Opus 4.6

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>
---
 pkg/deploy/dashboard/rbac.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkg/deploy/dashboard/rbac.go b/pkg/deploy/dashboard/rbac.go
index 85a30cb2de..023750b108 100644
--- a/pkg/deploy/dashboard/rbac.go
+++ b/pkg/deploy/dashboard/rbac.go
@@ -53,6 +53,11 @@ func GetPrivilegedPoliciesRulesForKubernetes() []rbacv1.PolicyRule {
 			Resources: []string{"configmaps"},
 			Verbs:     []string{"get", "list"},
 		},
+		{
+			APIGroups: []string{"controller.devfile.io"},
+			Resources: []string{"devworkspaceoperatorconfigs"},
+			Verbs:     []string{"get"},
+		},
 	}
 
 	if !infrastructure.IsOpenShift() {