From d63f8277134097abaef7fd8eab4ca5992aa6eacd Mon Sep 17 00:00:00 2001
From: jordan <jordan.washburn@gmail.com>
Date: Mon, 9 Feb 2026 19:35:28 -0700
Subject: [PATCH] fix(rbac): grant woodpecker-deployer access to statefulsets

The CI deploy step runs `kubectl set image statefulset/claudebox` but
the woodpecker-deployer Role only included `deployments`. Add
`statefulsets` to the allowed resources.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 deployments/k8s/base/rbac.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deployments/k8s/base/rbac.yaml b/deployments/k8s/base/rbac.yaml
index 78db56d..78d5648 100644
--- a/deployments/k8s/base/rbac.yaml
+++ b/deployments/k8s/base/rbac.yaml
@@ -63,7 +63,7 @@ metadata:
     app.kubernetes.io/part-of: rdev
 rules:
   - apiGroups: ["apps"]
-    resources: ["deployments"]
+    resources: ["deployments", "statefulsets"]
     verbs: ["get", "list", "patch", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1