riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

fix: grant queue-operator create/delete RBAC on temporalworkers

Browse Source 
ClusterRole only had get/list/watch/update/patch on temporalworkers
(inherited from a combined queues+temporalworkers rule), missing create
needed by reconcileTemporalWorker's cross-namespace (sqs -> temporal)
CreateOrUpdate call. Split into separate rule blocks per resource so each
carries its own correct verb set.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
Story Crater Bot
2026-08-17 09:39:01 -07:00
co-authored by Claude Sonnet 5
parent bf1682dc9b
commit c364ce2e1a
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/apps/messaging/queue-crd/templates/rbac.yaml
+12 -3
View File
@@ -10,13 +10,22 @@ metadata:
name: queue-operator
rules:
- apiGroups: ["kmsvc.io"]
resources: ["queues", "temporalworkers"]
resources: ["queues"]
verbs: ["get", "list", "watch", "update", "patch"]
- apiGroups: ["kmsvc.io"]
resources: ["queues/status", "temporalworkers/status"]
resources: ["queues/status"]
verbs: ["get", "update", "patch"]
- apiGroups: ["kmsvc.io"]
resources: ["queues/finalizers", "temporalworkers/finalizers"]
resources: ["queues/finalizers"]
verbs: ["update"]
- apiGroups: ["kmsvc.io"]
resources: ["temporalworkers"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["kmsvc.io"]
resources: ["temporalworkers/status"]
verbs: ["get", "update", "patch"]
- apiGroups: ["kmsvc.io"]
resources: ["temporalworkers/finalizers"]
verbs: ["update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]