diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 9b7de1fc..098a756a 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -120,3 +120,11 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - syn.tools
+  resources:
+  - tenanttemplates
+  verbs:
+  - get
+  - list
+  - watch
diff --git a/controllers/tenant_controller.go b/controllers/tenant_controller.go
index bff4ca1f..1f6c5c2d 100644
--- a/controllers/tenant_controller.go
+++ b/controllers/tenant_controller.go
@@ -25,6 +25,7 @@ type TenantReconciler struct {
 //+kubebuilder:rbac:groups=syn.tools,resources=tenants,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=syn.tools,resources=tenants/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=syn.tools,resources=tenants/finalizers,verbs=update
+//+kubebuilder:rbac:groups=syn.tools,resources=tenanttemplates,verbs=get;list;watch
 
 // Reconcile The Controller will requeue the Request to be processed again if the returned error is non-nil or
 // Result.Requeue is true, otherwise upon completion it will remove the work from the queue.