feat(iam): run the controller with the RBAC and image it needs

Three faults stopped the controller from running, each found by running it: image arch the first build was arm64 and every node is amd64, so the pod died with 'exec format error'. imagePullPolicy IfNotPresent kept the cached wrong-arch layer, so it is now Always. leases leader election needs coordination.k8s.io/leases. Without it the controller never acquired its lock and never reconciled. secrets list the manager caches Secrets, so it needs list and watch, not only get, create, update and patch. go.mod and go.sum gained the procfs entry the build needs.
2026-10-27 17:46:25 -07:00
parent 7cd7e8808c
commit 3630721366
4 changed files with 61 additions and 3 deletions
@@ -29,7 +29,7 @@ spec:
      containers:
        - name: controller
          image: forgejo.riotpiao.com/riotpiao-poimen/key-rotation-controller:0.1.0
-          imagePullPolicy: IfNotPresent
+          imagePullPolicy: Always
          args:
            - --scan-interval=10m
          env: