yeah i think you need a service account that has get/list/watch on the endpoints resource