From 044dae0d1e5785238f68e35a97d0f79eddfc2d45 Mon Sep 17 00:00:00 2001 From: mattia-eleuteri Date: Mon, 2 Feb 2026 15:26:26 +0100 Subject: [PATCH] fix coredns serviceaccount to match kubernetes bootstrap rbac The Kubernetes bootstrap creates a ClusterRoleBinding 'system:kube-dns' that references ServiceAccount 'kube-dns' in 'kube-system'. However, the coredns chart was using the 'default' ServiceAccount because serviceAccount.create was not enabled. This caused CoreDNS pods to fail with 'Failed to watch' errors after restarts, as they lacked RBAC permissions to watch the Kubernetes API. Configure the chart to create the 'kube-dns' ServiceAccount, which matches the expected binding from Kubernetes bootstrap. Co-Authored-By: Claude Opus 4.5 Signed-off-by: mattia-eleuteri (cherry picked from commit 7320edd71d453ebfc676f98e67e3cd645e0c9c62) --- packages/system/coredns/values.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/system/coredns/values.yaml b/packages/system/coredns/values.yaml index a1061a1eb..7f6403b88 100644 --- a/packages/system/coredns/values.yaml +++ b/packages/system/coredns/values.yaml @@ -6,3 +6,6 @@ coredns: k8sAppLabelOverride: kube-dns service: name: kube-dns + serviceAccount: + create: true + name: kube-dns