Missing resource in ClusterRole calico-kube-controllers

[tlemarchand]

Tigera operator v1.42.0 is deployed in my cluster using this documentation : https://docs.tigera.io/calico/latest/getting-started/kubernetes/quickstart#step-2-install-calico

In my calico-kube-controllers logs I get a repeating error :

2026-05-23 08:12:59.880 [INFO][15] kube-controllers/loadbalancer_controller.go 264: Running periodic IPAM sync of Service LoadBalancer
2026-05-23 08:12:59.881 [INFO][15] kube-controllers/loadbalancer_controller.go 590: Service requires an IP assignment envoy-gateway-system/envoy-envoy-gateway-system-internet-bb15c8b7
2026-05-23 08:12:59.881 [INFO][15] kube-controllers/loadbalancer_controller.go 740: Service envoy-gateway-system/envoy-envoy-gateway-system-internet-bb15c8b7 requires 1 IPv4 and 1 IPv6 addresses.
2026-05-23 08:12:59.881 [INFO][15] kube-controllers/ipam.go 118: Auto-assign 1 ipv4, 1 ipv6 addrs for host 'load-balancer'
2026-05-23 08:12:59.888 [INFO][15] kube-controllers/ipam.go 723: Looking up existing affinities for host handle="lb-JVzrjxJ5faizwGlXVFsgz8OPjK6s5apKTkqySsAoBk" host="load-balancer"
2026-05-23 08:12:59.893 [INFO][15] kube-controllers/ipam.go 415: Looking up existing affinities for host host="load-balancer"
2026-05-23 08:12:59.900 [ERROR][15] kube-controllers/ipam.go 2106: Error getting IPAM config error=connection is unauthorized: ipamconfigs.crd.projectcalico.org "default" is forbidden: User "system:serviceaccount:calico-system:calico-kube-controllers" cannot get resource "ipamconfigs" in API group "crd.projectcalico.org" at the cluster scope
2026-05-23 08:12:59.900 [ERROR][15] kube-controllers/ipam.go 132: Error assigning IPV4 addresses: connection is unauthorized: ipamconfigs.crd.projectcalico.org "default" is forbidden: User "system:serviceaccount:calico-system:calico-kube-controllers" cannot get resource "ipamconfigs" in API group "crd.projectcalico.org" at the cluster scope
2026-05-23 08:12:59.900 [WARNING][15] kube-controllers/loadbalancer_controller.go 789: error on assigning IP address to service error=connection is unauthorized: ipamconfigs.crd.projectcalico.org "default" is forbidden: User "system:serviceaccount:calico-system:calico-kube-controllers" cannot get resource "ipamconfigs" in API group "crd.projectcalico.org" at the cluster scope svc="envoy-envoy-gateway-system-internet-bb15c
8b7"                                                                              
2026-05-23 08:12:59.900 [ERROR][15] kube-controllers/loadbalancer_controller.go 593: Failed to assign IP for envoy-gateway-system/envoy-envoy-gateway-system-internet-bb15c8b7 error=connection is unauthorized: ipamconfigs.crd.projectcalico.org "default" is forbidden: User "system:serviceaccount:calico-system:calico-kube-controllers" cannot get resource "ipamconfigs" in API group "crd.projectcalico.org" at the cluster scope

I've checked the clusterrole calico-kube-controllers that is deployed by tigera operator, it seems that the ressource "ipamconfigs" is indeed missing. However there is an "ipamconfigurations" ressource.

kubectl get clusterrole calico-kube-controllers -o yaml                
                                                                                                                                                                                                                                                                                  
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:   
  creationTimestamp: "2026-05-23T07:24:54Z"
  labels:                
    app.kubernetes.io/component: Installation.operator.tigera.io
    app.kubernetes.io/instance: default
    app.kubernetes.io/managed-by: tigera-operator
    app.kubernetes.io/name: calico-kube-controllers
    app.kubernetes.io/part-of: Calico
    k8s-app: calico-kube-controllers
  name: calico-kube-controllers
  ownerReferences:
  - apiVersion: operator.tigera.io/v1
    blockOwnerDeletion: true
    controller: true 
    kind: Installation   
    name: default
    uid: b41f9b8d-bb66-46a9-9cbe-5ed2a450b89c
  resourceVersion: "1073763817"
  uid: f6efe698-b4e4-42a1-91e2-0b305b511fa5
rules:    
- apiGroups:
  - ""  
  resources:
  - nodes   
  - endpoints
  - services
  verbs:      
  - watch
  - list
  - get 
- apiGroups:
  - ""      
  resources:
  - pods        
  verbs:       
  - get     
  - list      
  - watch
- apiGroups:
  - ""      
  resources:         
  - services             
  - services/status
  verbs:           
  - get                  
  - list                 
  - update                     
  - watch
- apiGroups:
  - projectcalico.org
  - crd.projectcalico.org
  resources:
  - ipreservations
  verbs:  
  - list    
- apiGroups:   
  - projectcalico.org
  - crd.projectcalico.org  
  resources:       
  - blockaffinities
  - ipamblocks
  - ipamhandles
  - networksets
  - ipamconfigurations
  verbs:                       
  - get     
  - list               
  - create                    
  - update
  - delete
  - watch
- apiGroups:
  - projectcalico.org
  - crd.projectcalico.org
  resources:
  - ippools 
  - ippools/status      
  verbs:    
  - list                     
  - watch
  - update
- apiGroups:
  - projectcalico.org
  - crd.projectcalico.org                                                                                                                                                                                           
  resources:                                                  
  - clusterinformations                                       
  verbs:                                                                                                                                                                                                                                                                                                                                                                                                                                 
  - get
  - create
  - update
  - list
  - watch
- apiGroups:
  - projectcalico.org
  - crd.projectcalico.org
  resources:
  - hostendpoints
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - watch
- apiGroups:
  - projectcalico.org
  - crd.projectcalico.org
  resources:
  - kubecontrollersconfigurations
  - kubecontrollersconfigurations/status
  verbs:
  - get
  - create
  - list
  - update
  - watch
- apiGroups:
  - projectcalico.org
  - crd.projectcalico.org
  resources:
  - tiers
  verbs:
  - create
  - update
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apps
  resourceNames:
  - calico-node
  resources:
  - daemonsets
  verbs:
  - get
- apiGroups:
  - projectcalico.org
  - crd.projectcalico.org
  resources:
  - networkpolicies
  - globalnetworkpolicies
  - stagednetworkpolicies
  - stagedglobalnetworkpolicies
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
- apiGroups:
  - kubevirt.io
  resources:
  - virtualmachineinstances
  - virtualmachines
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - migration.projectcalico.org
  resources:
  - datastoremigrations
  - datastoremigrations/status
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch

When I add "ipamconfigs" the error stops, but it reappears once tigera operator reconciles the ClusterRole.

[evilhamsterman]

I too am running into this as well. It is leaving my loadbalancer IPs in a pending state because the controller cannot look up the resources. Workaround is to add your own RBAC that the operator doesn't reconcile.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: calico-kube-controllers-ipamconfigs
rules:
  - apiGroups:
      - crd.projectcalico.org
    resources:
      - ipamconfigs
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: calico-kube-controllers-ipamconfigs
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: calico-kube-controllers-ipamconfigs
subjects:
  - kind: ServiceAccount
    name: calico-kube-controllers
    namespace: calico-system

[github-actions]

This issue is stale because it has been open for 30 days with no activity.

[evilhamsterman]

I believe this is still an active issue