VMAgent ingestOnlyMode: config-reloader crashes with RBAC forbidden error on secret watch #1828
Description
Description
When deploying VMAgent with ingestOnlyMode: true, the config-reloader sidecar crashes during initialization with a forbidden error while attempting to read a secret that doesn't exist or isn't needed in ingest-only mode
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMAgent
metadata:
name: vm-ingestor
spec:
replicaCount: 2
ingestOnlyMode: true
remoteWrite:
- url: http://vminsert:8480/insert/0/prometheus
inlineUrlRelabelConfig:
- action: drop
source_labels: [environment]
The config-reloader sidecar fails fatally on startup:
vmagent-vm-ingestor-7f99fc49ff-wvz8x config-reloader 2026-02-19T11:55:11.552Z fatal \
/workspace/cmd/config-reloader/k8s_watch.go:123 \
cannot get secret during init secretName: vmagent-vm-ingestor, namespace: default, \
err: secrets "vmagent-vm-ingestor" is forbidden: User \
"system:serviceaccount:default:vmagent-vm-ingestor" cannot get resource "secrets" \
in API group "" in the namespace "default"
** Operator version:** v0.67.0