Consul sync catalog ClusterRole error "endpoints ${serviceName}" is forbidden

[gaeulautumn]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

---

Overview of the Issue

After this work, consul catalog sync is not working.

Reproduction Steps

consul-k8s helm chart v1.4.0

1. When running helm install with the following values.yml:

consul:
  global:
    image: {consul:1.18.0}
    imageK8S: {consul-k8s-control-plane:1.4.0}
    imageConsulDataplane: {consul-dataplane:1.4.0}
    imagePullSecrets:
      - name: {secret}
    datacenter: {datacenter}
    logLevel: "debug"
    gossipEncryption:
      secretName: consul.gossip.encrypt
      secretKey: encrypt

...

  syncCatalog:
    enabled: true
    default: false
    toK8S: false
    addK8SNamespaceSuffix: false
    aclSyncToken:
      secretName: consul.acl.token
      secretKey: sync
    ingress:
      enabled: true
  connectInject:
    enabled: false

Logs

[WARN]  to-consul/source: error loading initial endpoints: key={namespace/serviceId} err="endpoints \"{serviceId}\" is forbidden: User \"system:serviceaccount:consul:{name}\" cannot get resource \"endpoints\" in API group \"\" in the namespace \"{namespace}\""

(I replaced domain specific words into variables)

Expected behavior

Services in k8s should be registered to consul but wasn't.

Environment details

Additional Context

I was using consul-k8s helm chart v1.4.0 and consul catalog sync worked fine.
But when I try to deploy consul catalog sync using consul-k8s helm chart v1.5.1, it failed.

So I added ClusterRole like below, then it worked.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  namespace: consul
  name: {name}
rules:
  - apiGroups:
      - ""
    resources:
      - endpoints
    verbs:
      - get
      - list
      - watch
      - update
      - patch
      - delete
      - create

But it should work without custom defined ClusterRole.

And I found this works which might be the cause.

Did I miss something or is this a bug?