Use GetAPIReader and fix RBAC

Author: bjee19

deploy/helm-chart/templates/rbac.yaml

@@ -21,13 +21,23 @@ rules:
   - namespaces
   - services
   - secrets
-  # FIXME(bjee19): make nodes permission dependent on telemetry being enabled.
-  # https://github.com/nginxinc/nginx-gateway-fabric/issues/1317.
-  - nodes
-  - pods
   verbs:
   - list
   - watch
+# FIXME(bjee19): make nodes, pods, replicasets permission dependent on telemetry being enabled.
+# https://github.com/nginxinc/nginx-gateway-fabric/issues/1317.
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - list
 - apiGroups:
   - ""
   resources:
@@ -36,12 +46,11 @@ rules:
   - create
   - patch
 - apiGroups:
-    - apps
+  - apps
   resources:
-    - replicasets
+  - replicasets
   verbs:
-    - list
-    - watch
+  - get
 - apiGroups:
   - discovery.k8s.io
   resources:

deploy/manifests/nginx-gateway.yaml

@@ -32,13 +32,23 @@ rules:
   - namespaces
   - services
   - secrets
-  # FIXME(bjee19): make nodes permission dependent on telemetry being enabled.
-  # https://github.com/nginxinc/nginx-gateway-fabric/issues/1317.
-  - nodes
-  - pods
   verbs:
   - list
   - watch
+# FIXME(bjee19): make nodes, pods, replicasets permission dependent on telemetry being enabled.
+# https://github.com/nginxinc/nginx-gateway-fabric/issues/1317.
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - list
 - apiGroups:
   - ""
   resources:
@@ -47,12 +57,11 @@ rules:
   - create
   - patch
 - apiGroups:
-    - apps
+  - apps
   resources:
-    - replicasets
+  - replicasets
   verbs:
-    - list
-    - watch
+  - get
 - apiGroups:
   - discovery.k8s.io
   resources:

internal/mode/static/manager.go

@@ -216,7 +216,7 @@ func StartManager(cfg config.Config) error {
 	}
 
 	dataCollector := telemetry.NewDataCollectorImpl(telemetry.DataCollectorConfig{
-		K8sClientReader:     mgr.GetClient(),
+		K8sClientReader:     mgr.GetAPIReader(),
 		GraphGetter:         processor,
 		ConfigurationGetter: eventHandler,
 		Version:             cfg.Version,