From c0fa91c92a0426cb02925ff5c2581c1ad3b7247f Mon Sep 17 00:00:00 2001
From: miki3421 <42601846+miki3421@users.noreply.github.com>
Date: Thu, 22 Oct 2026 11:00:41 +0200
Subject: [PATCH] Reconcile reduced monitoring RBAC before operator upgrades on
 0.9.0

---
 setup/kubernetes/opsfile.yml                             | 2 ++
 .../roles/openserverless-monitoring-roles.yaml           | 9 +--------
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/setup/kubernetes/opsfile.yml b/setup/kubernetes/opsfile.yml
index 1495f18..0aa348f 100644
--- a/setup/kubernetes/opsfile.yml
+++ b/setup/kubernetes/opsfile.yml
@@ -414,6 +414,8 @@ tasks:
     desc: update the operator using the latest version configured in nuvroot.json if it is different than the current deployed one
     cmds:
       - "kubectl apply -f crds"
+      # Cluster-scoped collector RBAC must be reconciled by the admin client.
+      - "kubectl apply -f roles/openserverless-monitoring-roles.yaml"
       - task: operator
       - kubectl -n openserverless rollout restart statefulset openserverless-operator
     preconditions:
diff --git a/setup/kubernetes/roles/openserverless-monitoring-roles.yaml b/setup/kubernetes/roles/openserverless-monitoring-roles.yaml
index 6893617..c984540 100644
--- a/setup/kubernetes/roles/openserverless-monitoring-roles.yaml
+++ b/setup/kubernetes/roles/openserverless-monitoring-roles.yaml
@@ -223,13 +223,6 @@ rules:
   verbs:
   - list
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - list
-  - watch
 - apiGroups:
   - ""
   resources:
@@ -292,4 +285,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: openserverless-prometheus-kube-state-metrics
-  namespace: openserverless
\ No newline at end of file
+  namespace: openserverless