From 00e371217548223c76139a8f84c54e5700312d48 Mon Sep 17 00:00:00 2001
From: Support <support@masblue.studio>
Date: Tue, 23 Jun 2026 06:56:11 +0900
Subject: [PATCH] =?UTF-8?q?fix(rbac):=20operator=20ClusterRole=20pods=20de?=
 =?UTF-8?q?lete=20=EA=B6=8C=ED=95=9C=20=EC=B6=94=EA=B0=80=20(reseedStandby?=
 =?UTF-8?q?=20=EC=9E=91=EB=8F=99)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

reseedStandby/reconcileStaleReplicas(#205/#220)가 stuck standby(primary 승격 후 timeline divergence 등)의 pod+PVC를 삭제해 fresh pg_basebackup 으로 재clone 한다. chart RBAC 가 pods verbs 에 delete 누락(get/list/watch/patch 만) → reseed 의 pod 삭제 단계가 forbidden → timeline-stuck replica 영구 방치(라이브 postgres-prod shard-0-1 8h+ stuck 실측). PVC delete 는 이미 있었으나 pod delete 누락이 reseed 무력화.

라이브 RCA: kubectl auth can-i delete pods (operator SA) = no. 본 fix 로 reseed 완전 작동. helm template verbs=[get,list,watch,patch,delete] 렌더 검증.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 charts/postgres-operator/templates/rbac.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/charts/postgres-operator/templates/rbac.yaml b/charts/postgres-operator/templates/rbac.yaml
index 0408873..4c4ce93 100644
--- a/charts/postgres-operator/templates/rbac.yaml
+++ b/charts/postgres-operator/templates/rbac.yaml
@@ -41,7 +41,10 @@ rules:
     verbs: [get, list, watch, patch, update]
   - apiGroups: [""]
     resources: [pods]
-    verbs: [get, list, watch, patch]
+    # delete: reseedStandby/reconcileStaleReplicas(#205/#220)가 stuck standby(timeline
+    # divergence 등)의 pod+PVC를 삭제해 StatefulSet 이 fresh pg_basebackup 으로 재clone.
+    # delete 누락 시 reseed 가 pod 삭제에서 forbidden → timeline-stuck replica 영구 방치.
+    verbs: [get, list, watch, patch, delete]
   - apiGroups: [""]
     resources: [pods/exec]
     verbs: [create]