[Moulick]

Description

Add missing permissions to get/list/watch endpointslices.discovery.k8s.io. Seems to have been missed in #850

Type of change

• Bug fix (non-breaking change that fixes an issue)

How has this been tested?

Adding to additionalCrdGroups locally

Describe the tests you ran to verify your changes.

• Tested against a remote cluster

Error fixed: radar 2026/06/05 14:53:52 [resource-counts] Failed to count EndpointSlice: failed to list resources: endpointslices.discovery.k8s.io is forbidden: User "system:serviceaccount:radar:radar" cannot list resource "endpointslices" in API group "discovery.k8s.io" at the cluster scope

Related issues

Fixes #848

[Moulick]

Question, the #848 talks about editing Endpoint slices, this PR only adds get/list/watch, should it also have patch/update/delete @nadaverell?

[nadaverell]

Good question — keep it get/list/watch only. The chart's ClusterRole is deliberately read-only across the board (no write verbs on pods, deployments, or anything else — the only exception is the rbac.helm wildcard, since charts can create arbitrary kinds).

Editing works through a different path: with auth enabled, Radar impersonates the requesting user, so the apiserver enforces their RBAC, not the ServiceAccount's. For no-auth installs where you want the SA itself to write, rbac.additionalRules is the escape hatch.

So this PR fully fixes #848 — once the SA can read EndpointSlices, editing them works wherever editing anything else works. Thanks for the fix!

[nadaverell]

LGTM — thanks for catching this!