The RBAC shipped with venafi-kubernetes-agent contained a syntax error which prevents the OpenShift Routes from being collected.

Users would have seen the following errors:

k8s.io/[email protected]/tools/cache/reflector.go:243: failed to list route.openshift.io/v1, Resource=routes: routes.route.openshift.io is forbidden: User "system:serviceaccount:venafi:venafi-kubernetes-agent" cannot list resource "routes" in API group "route.openshift.io" at the cluster scope

The RBAC API Group field is documented as follows:

$ kubectl explain clusterrole.rules.apiGroups
GROUP:      rbac.authorization.k8s.io
KIND:       ClusterRole
VERSION:    v1

FIELD: apiGroups <[]string>

DESCRIPTION:
    APIGroups is the name of the APIGroup that contains the resources.  If
    multiple API groups are specified, any action requested against one of the
    enumerated resources in any API group will be allowed. "" represents the
    core API group and "*" represents all API groups.

The OpenShift route CRD can be installed as follows:

kubectl apply -f https://raw.githubusercontent.com/openshift/api/release-4.18/route/v1/zz_generated.crd-manifests/routes-Default.crd.yaml

• https://github.com/openshift/api/blob/master/route/v1/zz_generated.crd-manifests/routes-Default.crd.yaml