From 3e81b4454df4eb703b5417eb882d368dfde36b89 Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Mon, 17 Aug 2026 09:33:16 -0700 Subject: [PATCH] fix: grant queue-operator create/delete RBAC on TemporalWorker and Deployment Deployed ClusterRole only had get/list/watch/update/patch on temporalworkers, missing create/delete needed by reconcileTemporalWorker's cross-namespace (sqs -> temporal) CreateOrUpdate call, and never granted apps/deployments at all -- both required for the auto-provisioned TemporalWorker + backing Deployment to reconcile successfully. Co-Authored-By: Claude Sonnet 5 --- k8s/charts/queue-crd/templates/rbac.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/k8s/charts/queue-crd/templates/rbac.yaml b/k8s/charts/queue-crd/templates/rbac.yaml index 39a46d7..20da39b 100644 --- a/k8s/charts/queue-crd/templates/rbac.yaml +++ b/k8s/charts/queue-crd/templates/rbac.yaml @@ -18,6 +18,15 @@ rules: - apiGroups: ["kmsvc.io"] resources: ["queues/finalizers"] verbs: ["update"] + - apiGroups: ["kmsvc.io"] + resources: ["temporalworkers"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: ["kmsvc.io"] + resources: ["temporalworkers/status"] + verbs: ["get", "update", "patch"] + - apiGroups: ["kmsvc.io"] + resources: ["temporalworkers/finalizers"] + verbs: ["update"] - apiGroups: ["coordination.k8s.io"] resources: ["leases"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] @@ -27,6 +36,9 @@ rules: - apiGroups: [""] resources: ["pods", "nodes"] verbs: ["get"] + - apiGroups: ["apps"] + resources: ["deployments"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding