The .lok8s/addons/external-dns chart (upstream external-dns 1.21.1) derives its ClusterRole from sources. With service in the list it grants services/endpoints/pods read but NOT discovery.k8s.io/endpointslices — yet the service source's informer watches EndpointSlices, so the controller fatal-loops failed to sync *v1.EndpointSlice ... context deadline exceeded until the rule is added.
Found live 2026-08-31 (kubehz.in.net, publishing extcp-ds.kubehz.in.net from a LoadBalancer Service). Worked around by patching the live ClusterRole with discovery.k8s.io/endpointslices: [get,list,watch]. The addon should add this rule (or an rbac.additionalPermissions values entry) whenever service is in sources, so a fresh lo provision renders a working Role.
🤖 Generated with Claude Code
The
.lok8s/addons/external-dnschart (upstream external-dns 1.21.1) derives its ClusterRole fromsources. Withservicein the list it grantsservices/endpoints/podsread but NOTdiscovery.k8s.io/endpointslices— yet the service source's informer watches EndpointSlices, so the controller fatal-loopsfailed to sync *v1.EndpointSlice ... context deadline exceededuntil the rule is added.Found live 2026-08-31 (kubehz.in.net, publishing extcp-ds.kubehz.in.net from a LoadBalancer Service). Worked around by patching the live ClusterRole with
discovery.k8s.io/endpointslices: [get,list,watch]. The addon should add this rule (or anrbac.additionalPermissionsvalues entry) wheneverserviceis in sources, so a freshlo provisionrenders a working Role.🤖 Generated with Claude Code