From 9e9595357a9bf587c4ecb19f68607d11f05966dc Mon Sep 17 00:00:00 2001
From: Cayla Fauver <cayla@cay.la>
Date: Fri, 20 Feb 2026 19:47:38 -0500
Subject: [PATCH] Update helm RBAC to account for pvc failure on 0.35.0 (#1836)

* Synchronize helm clusterrole RBAC with base yaml

I noticed in v0.35.

```
E0219 23:53:57.761596       1 reflector.go:204] "Failed to watch" err="failed to list *v1.PersistentVolumeClaim: persistentvolumeclaims is forbidden: User \"system:serviceaccount:kube-system:descheduler\" cannot list resource \"persistentvolumeclaims\" in API group \"\" at the cluster scope" logger="UnhandledError" reflector="k8s.io/client-go/informers/factory.go:161" type="*v1.PersistentVolumeClaim"
```

I saw it in rbac.yaml https://github.com/kubernetes-sigs/descheduler/blob/bec9cd38d01eab2d35f1d76b1b9845649e11bffa/kubernetes/base/rbac.yaml#L38-L40

So I figured this just needed a bump

* remove dupe

* undo version change
---
 charts/descheduler/templates/clusterrole.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/charts/descheduler/templates/clusterrole.yaml b/charts/descheduler/templates/clusterrole.yaml
index 605b28886..68ae90787 100644
--- a/charts/descheduler/templates/clusterrole.yaml
+++ b/charts/descheduler/templates/clusterrole.yaml
@@ -36,6 +36,9 @@ rules:
   resourceNames: ["{{ .Values.leaderElection.resourceName | default "descheduler" }}"]
   verbs: ["get", "patch", "delete"]
 {{- end }}
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims"]
+  verbs: ["get", "watch", "list"]
 {{- if and .Values.deschedulerPolicy }}
 {{- range .Values.deschedulerPolicy.metricsProviders }}
 {{- if and (hasKey . "source") (eq .source "KubernetesMetrics") }}