Helm upgrade fails with an RBAC permission error for Gateway API HTTPRoute support

Issue

When upgrading CloudBees CI on modern cloud platforms - operations center using the cloudbees-core Helm chart on OpenShift, the upgrade fails while Helm tries to patch the cjoc-master-management Role. The following error appears:

Error: UPGRADE FAILED: cannot patch "cjoc-master-management" with kind Role: roles.rbac.authorization.k8s.io "cjoc-master-management" is forbidden: user "system:serviceaccount:cjoc:deployer" (groups=["system:serviceaccounts" "system:serviceaccounts:cjoc" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
{APIGroups:["gateway.networking.k8s.io"], Resources:["httproutes"], Verbs:["*"]}▼

This prevents the Helm upgrade from completing.

Environment

CloudBees CI on modern cloud platforms - operations center

Explanation

Kubernetes blocks a service account from creating or updating a Role or ClusterRole that defines a permission the service account does not already hold itself. See Restrictions on role creation or update for details on this Kubernetes RBAC behavior.

The cjoc-master-management Role managed by the cloudbees-core Helm chart includes a gateway.networking.k8s.io/httproutes permission when Gateway API routing is used. Per Migrate from Ingress to Gateway API, this permission is normally granted automatically to the service account running Helm once the Gateway API CRDs are available in the cluster. If that service account’s own Role or ClusterRole does not already hold the gateway.networking.k8s.io/httproutes permission, Helm cannot patch cjoc-master-management with it, and the upgrade fails with the error above.

Resolution

List the permissions currently held by the service account running the Helm upgrade (replace cjoc and deployer with the applicable namespace and service account name):
```
oc auth can-i --list --as=system:serviceaccount:cjoc:deployer▼
```
Confirm that httproutes under the gateway.networking.k8s.io API group is missing from the output.
Add the following rule to that service account’s own Role (or ClusterRole, if permissions are managed cluster-wide):
```
rules:
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - httproutes
  verbs:
  - '*'▼
```
Re-run oc auth can-i --list --as=system:serviceaccount:cjoc:deployer and confirm httproutes now appears with the added verb.
Re-run the Helm upgrade.

This same Kubernetes RBAC restriction can occur for other APIGroups/Resources/Verbs combinations as the cloudbees-core Helm chart evolves. Read the exact values reported in the error message and add that exact permission to the deployer service account’s own Role or ClusterRole at the matching scope.

References

This article is part of our Knowledge Base and is provided for guidance-based purposes only. The solutions or workarounds described here are not officially supported by CloudBees and may not be applicable in all environments. Use at your own discretion, and test changes in a safe environment before applying them to production systems.