Comment 7 for bug 1940526

(as a side note it would actually be useful for a charm to be able to explicitly state what access it needs to the K8S API in order to operator - in my charm RabbitMQ just won't cluster until it has this access so maybe it should be considered essential - it can also be scoped to just the namespace and the service itself rather than anything wider)

I can update the Role that Juju creates to match the upstream reference:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: rabbitmq
  namespace: test-rabbitmq
rules:
- apiGroups: [""]
  resources: ["endpoints"]
  verbs: ["get"]
- apiGroups: [""]
  resources: ["events"]
  verbs: ["create"]

and the native K8S peer discovery works fine.