This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pulsar-helm-chart.git
The following commit(s) were added to refs/heads/master by this push:
new a1fb893 Fix oxia coordinator RoleBinding roleRef.apiGroup to prevent
GitOps drift (#676)
a1fb893 is described below
commit a1fb8938dd0514c39c778a5f68524a9a24787d65
Author: Lari Hotari <[email protected]>
AuthorDate: Sat Apr 25 23:18:59 2026 +0300
Fix oxia coordinator RoleBinding roleRef.apiGroup to prevent GitOps drift
(#676)
The empty `apiGroup: ""` was silently filled in by the Kubernetes API
server with `rbac.authorization.k8s.io`. GitOps tools like Pulumi and
ArgoCD detected the mismatch on every reconcile and tried to recreate
the RoleBinding. Because `roleRef` is immutable, this caused the
binding to be deleted and recreated on every deployment.
---
charts/pulsar/templates/oxia-coordinator-rolebinding.yaml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/charts/pulsar/templates/oxia-coordinator-rolebinding.yaml
b/charts/pulsar/templates/oxia-coordinator-rolebinding.yaml
index 354d8df..de7c0e2 100644
--- a/charts/pulsar/templates/oxia-coordinator-rolebinding.yaml
+++ b/charts/pulsar/templates/oxia-coordinator-rolebinding.yaml
@@ -31,7 +31,7 @@ subjects:
name: {{ template "pulsar.fullname" . }}-{{ .Values.oxia.component
}}-coordinator
namespace: {{ template "pulsar.namespace" . }}
roleRef:
- apiGroup: ""
+ apiGroup: "rbac.authorization.k8s.io"
kind: Role
name: {{ template "pulsar.fullname" . }}-{{ .Values.oxia.component
}}-coordinator
{{- end }}
\ No newline at end of file
