From e98dd8b0a2b374f9a019661edf625abd9b6a09f9 Mon Sep 17 00:00:00 2001
From: pieced-ci <ci@pieced.ch>
Date: Fri, 1 May 2026 16:42:18 +0000
Subject: [PATCH] Sync chart from pieced-operator 0.1.38

---
 deploy/helm/pieced-operator/Chart.yaml          |  4 ++--
 deploy/helm/pieced-operator/templates/rbac.yaml | 10 +++++++++-
 deploy/helm/pieced-operator/values.yaml         |  2 +-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/deploy/helm/pieced-operator/Chart.yaml b/deploy/helm/pieced-operator/Chart.yaml
index 14affce..7a42b08 100644
--- a/deploy/helm/pieced-operator/Chart.yaml
+++ b/deploy/helm/pieced-operator/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: pieced-operator
 description: PieCed IT tenant lifecycle operator
-version: 0.1.37
-appVersion: "0.1.37"
+version: 0.1.38
+appVersion: "0.1.38"
 type: application
diff --git a/deploy/helm/pieced-operator/templates/rbac.yaml b/deploy/helm/pieced-operator/templates/rbac.yaml
index 2982bfe..b9ebde3 100644
--- a/deploy/helm/pieced-operator/templates/rbac.yaml
+++ b/deploy/helm/pieced-operator/templates/rbac.yaml
@@ -8,9 +8,17 @@ metadata:
     app.kubernetes.io/name: pieced-operator
 rules:
   # --- PiecedTenant CRD ---
+  # `delete` is required so the operator can self-initiate the post-
+  # 60-day cleanup of suspended tenants (Bug 37b). Without it, the
+  # `r.Delete(ctx, tenant)` call in the suspend block fails with a
+  # 403 every reconcile cycle while the tenant sits past its
+  # retention window. Until then this verb wasn't strictly needed —
+  # the customer/portal initiated CR deletes, and the operator's
+  # finalizer ran cleanup; only with operator-initiated deletion did
+  # the missing verb become a problem.
   - apiGroups: ["pieced.ch"]
     resources: ["piecedtenants"]
-    verbs: ["get", "list", "watch", "update", "patch"]
+    verbs: ["get", "list", "watch", "update", "patch", "delete"]
   - apiGroups: ["pieced.ch"]
     resources: ["piecedtenants/status"]
     verbs: ["get", "update", "patch"]
diff --git a/deploy/helm/pieced-operator/values.yaml b/deploy/helm/pieced-operator/values.yaml
index 6b2c043..555e6da 100644
--- a/deploy/helm/pieced-operator/values.yaml
+++ b/deploy/helm/pieced-operator/values.yaml
@@ -1,6 +1,6 @@
 image:
   repository: registry.c5ai.ch/pieced/pieced-operator
-  tag: "0.1.37"
+  tag: "0.1.38"
   pullPolicy: IfNotPresent
 
 imagePullSecrets: