diff --git a/kubernetes/apps/networking/external-dns/cluster-role.yml b/kubernetes/apps/networking/external-dns/cluster-role.yml
index 5e76bc1..b2a4508 100644
--- a/kubernetes/apps/networking/external-dns/cluster-role.yml
+++ b/kubernetes/apps/networking/external-dns/cluster-role.yml
@@ -5,14 +5,17 @@ metadata:
   name: external-dns
 rules:
   - apiGroups: [""]
-    resources: ["services", "endpoints", "pods"]
+    resources: ["endpoints", "pods", "services"]
     verbs: ["get", "watch", "list"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
+  - apiGroups: ["extensions"]
+    resources: ["ingresses"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["networking.k8s.io"]
     resources: ["ingresses"]
     verbs: ["get", "watch", "list"]
   - apiGroups: [""]
     resources: ["nodes"]
-    verbs: ["list", "watch"]
+    verbs: ["watch", "list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding