[Bug] The RBG controller's ServiceAccount, rbgs-controller-sa, lacks the permissions to get and create Secrets within the rbgs-system namespace. As a result, it is unable to automatically generate the TLS certificates required for the Webhook.

[jenveywang]

Checklist

• 1. I have searched related issues but cannot get the expected help.
• 2. The bug has not been fixed in the latest version.
• 3. Please note that if the bug-related issue you submitted lacks corresponding environment info and a minimal reproducible demo, it will be challenging for us to reproduce and resolve the issue, reducing the likelihood of receiving feedback.
• 4. If the issue you raised is not a bug but a question, please raise a discussion at https://github.com/sgl-project/sglang/discussions/new/choose Otherwise, it will be closed.
• 5. Please use English, otherwise it will be closed.

Describe the bug

While deploying rbg v0.7.0-alpha.3 on a new cluster, I discovered that the deployment manifests are missing a specific ServiceAccount permission.

The RBG controller's ServiceAccount, rbgs-controller-sa, lacks the permissions to get and create Secrets within the rbgs-system namespace. As a result, it is unable to automatically generate the TLS certificates required for the Webhook.

Reproduction

manifests.yaml
https://github.com/sgl-project/rbg/tree/main/deploy/kubectl/manifests.yaml

Environment

k8s version: v1.34.7
Processor Architecture: aarch64
OS: openEuler 22.03 (LTS-SP4)
rbg version: v0.7.0-alpha.3
rbg controller version: rolebasedgroup/rbgs-controller:v0.7.0-47b2681

pod Error message:
"level":"INFO","time":"2026-04-25T04:57:15.961Z","logger":"webhook-cert-manager","caller":"webhook/certmanager.go:75","message":"ensuring webhook TLS certificate","dnsName":"rbgs-webhook-service.rbgs-system.svc"}
{"level":"ERROR","time":"2026-04-25T04:57:15.965Z","logger":"setup","caller":"rbgs/main.go:308","message":"unable to provision webhook TLS certificate","error":"ensuring webhook cert: secrets "rbgs-webhook-cert" is forbidden: User "system:serviceaccount:rbgs-system:rbgs-controller-sa" cannot get resource "secrets" in API group "" in the namespace "rbgs-system"","stacktrace":"main.main\n\t/workspace/cmd/rbgs/main.go:308\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:283"}