<p>I'm trying to use my operator to check if a pod is sitting on a tainted node.</p>
<p>To get the node's taint information, I used</p>
<pre><code>err := r.Get(ctx, client.ObjectKey{Name: pod.Spec.NodeName}, node)
</code></pre>
<p>which works fine with the fakeclient in k8s.</p>
<p>However, when I run it against an EKS cluster, I got the following error:</p>
<pre><code>&quot;msg&quot;:&quot;pkg/mod/k8s.io/client-go@v0.24.10/tools/cache/reflector.go:167: failed to list *v1.Node: nodes is forbidden: User \&quot;system:serviceaccount:mike-6mdj7thh:mike-kubernetes-operator-controller-manager\&quot; cannot list resource \&quot;nodes\&quot; in API group \&quot;\&quot; at the cluster scope
</code></pre>
<p>How should I fix it? OR
How should I debug this type of issue?</p>

Mike
<p>It requires ClusterRole and ClusterRoleBinding to access Nodes.</p>
<pre><code>---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: mike-clusterrole
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - nodes
  verbs:
  - get
  - watch
  - list
  - create
  - update
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: mike-clusterrolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: mike-clusterrole
subjects:
- kind: ServiceAccount
  name: mike-kubernetes-operator-controller-manager
  namespace: {{ .Namespace }}
</code></pre>
