From c364ce2e1ae46a7fe140b0d4c4759925370721da Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Mon, 17 Aug 2026 09:39:01 -0700
Subject: [PATCH] fix: grant queue-operator create/delete RBAC on
 temporalworkers

ClusterRole only had get/list/watch/update/patch on temporalworkers
(inherited from a combined queues+temporalworkers rule), missing create
needed by reconcileTemporalWorker's cross-namespace (sqs -> temporal)
CreateOrUpdate call. Split into separate rule blocks per resource so each
carries its own correct verb set.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 k8s/apps/messaging/queue-crd/templates/rbac.yaml | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/k8s/apps/messaging/queue-crd/templates/rbac.yaml b/k8s/apps/messaging/queue-crd/templates/rbac.yaml
index f85a429..20da39b 100644
--- a/k8s/apps/messaging/queue-crd/templates/rbac.yaml
+++ b/k8s/apps/messaging/queue-crd/templates/rbac.yaml
@@ -10,13 +10,22 @@ metadata:
   name: queue-operator
 rules:
   - apiGroups: ["kmsvc.io"]
-    resources: ["queues", "temporalworkers"]
+    resources: ["queues"]
     verbs: ["get", "list", "watch", "update", "patch"]
   - apiGroups: ["kmsvc.io"]
-    resources: ["queues/status", "temporalworkers/status"]
+    resources: ["queues/status"]
     verbs: ["get", "update", "patch"]
   - apiGroups: ["kmsvc.io"]
-    resources: ["queues/finalizers", "temporalworkers/finalizers"]
+    resources: ["queues/finalizers"]
+    verbs: ["update"]
+  - apiGroups: ["kmsvc.io"]
+    resources: ["temporalworkers"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["kmsvc.io"]
+    resources: ["temporalworkers/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["kmsvc.io"]
+    resources: ["temporalworkers/finalizers"]
     verbs: ["update"]
   - apiGroups: ["coordination.k8s.io"]
     resources: ["leases"]