From 04c5576e0f2bef04e89b473ba13f4f55077bbcbd Mon Sep 17 00:00:00 2001
From: Stephane Loeuillet <stephane.loeuillet@kaiko.com>
Date: Fri, 30 Oct 2026 12:10:45 +0100
Subject: [PATCH] [fix](helm) operator RBAC matches config/operator manifests

The chart's ClusterRole and leader-election Role lagged behind
config/operator/{operator,disaggregated-operator}.yaml:

- pods delete and pods/exec create, added for the graceful compute-group
  shutdown (#502);
- persistentvolumeclaims create, added with operator-provisioned PVCs
  (ca0bf94, used when a volume sets `provisioner: operator`);
- events update in the leader-election Role.

Fixes #527

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 helm-charts/doris-operator/templates/clusterrole.yaml     | 8 ++++++++
 .../doris-operator/templates/leader-election-role.yaml    | 1 +
 2 files changed, 9 insertions(+)

diff --git a/helm-charts/doris-operator/templates/clusterrole.yaml b/helm-charts/doris-operator/templates/clusterrole.yaml
index fe9b18db..e9b78525 100644
--- a/helm-charts/doris-operator/templates/clusterrole.yaml
+++ b/helm-charts/doris-operator/templates/clusterrole.yaml
@@ -76,6 +76,13 @@ rules:
       - list
       - watch
       - update
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - pods/exec
+    verbs:
+      - create
   - apiGroups:
       - ""
     resources:
@@ -84,6 +91,7 @@ rules:
       - get
       - list
       - watch
+      - create
       - update
       - patch
       - delete
diff --git a/helm-charts/doris-operator/templates/leader-election-role.yaml b/helm-charts/doris-operator/templates/leader-election-role.yaml
index 90adc44f..8da483b1 100644
--- a/helm-charts/doris-operator/templates/leader-election-role.yaml
+++ b/helm-charts/doris-operator/templates/leader-election-role.yaml
@@ -59,3 +59,4 @@ rules:
     verbs:
       - create
       - patch
+      - update