From aae4e76e137664eb55adce7f11d1e7c65c96408b Mon Sep 17 00:00:00 2001 From: Manuel Grandeit Date: Tue, 16 Dec 2025 21:02:30 +0100 Subject: [PATCH] helm: add cephclusters/finalizers permission for mgr sidecar The watch-active sidecar reconciles Services and wants to set blockOwnerDeletion=true in the ownerReference. On clusters with OwnerReferencesPermissionEnforcement admission controller this requires the cephclusters/finalizers permission. Signed-off-by: Manuel Grandeit (cherry picked from commit 4f7ead07cac4a9ca2031e8e25d160ca536ba6367) --- deploy/charts/library/templates/_cluster-role.tpl | 1 + deploy/examples/common.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/deploy/charts/library/templates/_cluster-role.tpl b/deploy/charts/library/templates/_cluster-role.tpl index 14b2e979a..a95736641 100644 --- a/deploy/charts/library/templates/_cluster-role.tpl +++ b/deploy/charts/library/templates/_cluster-role.tpl @@ -61,6 +61,7 @@ rules: resources: - cephclients - cephclusters + - cephclusters/finalizers - cephblockpools - cephfilesystems - cephnfses diff --git a/deploy/examples/common.yaml b/deploy/examples/common.yaml index b9a6ea194..05b00aefc 100644 --- a/deploy/examples/common.yaml +++ b/deploy/examples/common.yaml @@ -998,6 +998,7 @@ rules: resources: - cephclients - cephclusters + - cephclusters/finalizers - cephblockpools - cephfilesystems - cephnfses