From 7d57befa4f6d0d43d06be8314a00236076bdfe04 Mon Sep 17 00:00:00 2001 From: Oleksii Kurinnyi Date: Thu, 19 Mar 2026 15:08:15 +0200 Subject: [PATCH] fix: grant dashboard SA read access to DevWorkspaceOperatorConfig (#2099) The dashboard backup feature needs to read the DWOC to get backup configuration (schedule, registry path, auth secret name). Without this permission, the dashboard SA gets 403 Forbidden when reading the DWOC in the DWO namespace, causing backup endpoints to fail for all users. Assisted-by: Claude Opus 4.6 Signed-off-by: Oleksii Kurinnyi Co-authored-by: Claude Opus 4.6 (1M context) --- pkg/deploy/dashboard/rbac.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkg/deploy/dashboard/rbac.go b/pkg/deploy/dashboard/rbac.go index 85a30cb2de..023750b108 100644 --- a/pkg/deploy/dashboard/rbac.go +++ b/pkg/deploy/dashboard/rbac.go @@ -53,6 +53,11 @@ func GetPrivilegedPoliciesRulesForKubernetes() []rbacv1.PolicyRule { Resources: []string{"configmaps"}, Verbs: []string{"get", "list"}, }, + { + APIGroups: []string{"controller.devfile.io"}, + Resources: []string{"devworkspaceoperatorconfigs"}, + Verbs: []string{"get"}, + }, } if !infrastructure.IsOpenShift() {