Support for K8S EndpointSlices

[raamkrisshna9]

Kubernetes v1.33 deprecates the Endpoints API in favor of EndpointSlices, which may require updates to Helm charts and API usage where applicable.

URL: https://github.com/kube-logging/logging-operator/blob/master/charts/logging-operator/templates/clusterrole.yaml#L34

[vyncint]

I had a go at this and hit something non-obvious that is worth writing down before anyone else tries the same thing.

The operator's own Go code never touches the Endpoints API. There is no corev1.Endpoints anywhere, no EndpointsList, no discovery.k8s.io import, and leader election uses the default lease lock (coordination.k8s.io/leases, granted separately in the same marker block). The only Endpoints identifiers in the tree are monitoringv1.Endpoint, which is the Prometheus ServiceMonitor type and unrelated.

So the endpoints grant on the linked ClusterRole line looks dead, and I assumed it could simply be dropped. It cannot.

The operator creates ClusterRoles for the aggregators, and both of them grant endpoints:

• pkg/resources/fluentd/rbac.go — configmaps, events, nodes, endpoints, services, pods
• pkg/resources/syslogng/rbac.go — the same set

Kubernetes RBAC privilege-escalation prevention means you cannot create a role granting permissions you do not hold yourself. Dropping endpoints from the operator's ClusterRole and deploying on kind, reconciliation fails immediately:

clusterroles.rbac.authorization.k8s.io "demo-fluentd-fluentd" is forbidden:
user "system:serviceaccount:logging:lo-logging-operator" is attempting to grant
RBAC permissions not currently held:
{APIGroups:[""], Resources:["endpoints"], Verbs:["get" "list" "watch"]}

Neither the Fluentd nor the syslog-ng StatefulSet is ever created. HostTailer and EventTailer come up fine, since their generated roles do not include endpoints.

So the operator holds endpoints purely to be able to delegate it, and the ordering for this issue is the other way round from what the linked line suggests:

1. Establish whether the Fluentd and syslog-ng pods actually need the Endpoints API. As far as I can tell fluent-plugin-kubernetes_metadata_filter queries pods and namespaces rather than endpoints, so this may just be an over-broad set inherited from a generic "read cluster objects" rule — but that is a question about the plugins' runtime behaviour and a user-visible one if it is wrong, so it needs someone who knows those code paths.
2. If they do need it, migrate those two roles to discovery.k8s.io/endpointslices.
3. Only then does the operator's own grant change to match.

I did not open a PR because step 1 is a maintainer call, and silently breaking metadata enrichment for someone is a bad trade for a tidier ClusterRole. Happy to do the mechanical work across all three roles once there is a decision on whether the aggregators need Endpoints at all.