# K3S Traefik 3 installation missing ClusterRoles

**URL:** <https://forums.suse.com/t/k3s-traefik-3-installation-missing-clusterroles/45128>\
**Category:** k3s, k3OS, and k3d\
**Created:** [February 13, 2025, 9:26am UTC](https://forums.suse.com/t/k3s-traefik-3-installation-missing-clusterroles/45128 "2025-02-13T09:26:03Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![andy\_dandy](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/andy_dandy/32/11978_2.png) [@andy\_dandy](https://forums.suse.com/u/andy_dandy)\
**Post date:** [February 13, 2025, 9:26am UTC](https://forums.suse.com/t/k3s-traefik-3-installation-missing-clusterroles/45128/1 "2025-02-13T09:26:03Z")

</div>

Good Day, Friends!

After upgrading my Traefik installation to v3, all ingresses were broken and cluster services not available. Traefik started to serve default certificates and every page were 404.

```auto
apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    image: 
      repository: rancher/mirrored-library-traefik
      tag: 3.3.3

```

These errors appeared in Traefik logs

```auto
W0211 11:14:18.951161 1 reflector.go:561] k8s.io/client-go@v0.31.1/tools/cache/reflector.go:243: failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User "system:serviceaccount:kube-system:traefik" cannot list resource "endpointslices" in API group "discovery.k8s.io" at the cluster scope
E0211 11:14:18.951285 1 reflector.go:158] "Unhandled Error" err="k8s.io/client-go@v0.31.1/tools/cache/reflector.go:243: Failed to watch *v1.EndpointSlice: failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User \"system:serviceaccount:kube-system:traefik\" cannot list resource \"endpointslices\" in API group \"discovery.k8s.io\" at the cluster scope" logger="UnhandledError"
W0211 11:14:20.490855 1 reflector.go:561] k8s.io/client-go@v0.31.1/tools/cache/reflector.go:243: failed to list *v1.Node: nodes is forbidden: User "system:serviceaccount:kube-system:traefik" cannot list resource "nodes" in API group "" at the cluster scope
E0211 11:14:20.491037 1 reflector.go:158] "Unhandled Error" err="k8s.io/client-go@v0.31.1/tools/cache/reflector.go:243: Failed to watch *v1.Node: failed to list *v1.Node: nodes is forbidden: User \"system:serviceaccount:kube-system:traefik\" cannot list resource \"nodes\" in API group \"\" at the cluster scope" logger="UnhandledError"

```

I could fix it by adding the desired definitions into the ClusterRole of Traefik

```auto
kubectl get clusterrole traefik-kube-system -o yaml > traefik-clusterrole.yaml
sed -i '21i\ - discovery.k8s.io' traefik-clusterrole.yaml
sed -i '25i\ - endpointslices' traefik-clusterrole.yaml
sed -i '35i\ - nodes' traefik-clusterrole.yaml

traefik_pod=$(kubectl get pod -n kube-system | grep "^traefik" | awk '{print $1}')
kubectl delete pod -n kube-system $traefik_pod

```

**The problem is, I have to do the fix everytime I do `kubectl apply -f traefik-values.yaml`.**  
I found nothing in the default values regarding this:

> <https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml>

K3S version

```auto
k3s version v1.31.4-rc1+k3s1 (a562d090)
go version go1.22.9

```

Best Regards