Found during the 2026-08 FerrVault operator audit.
Problem
triggerRollouts patches the pod-template restart annotation via r.Update(...) (internal/controller/ferrvaultsecret_sync.go:83), which issues an HTTP PUT (the update verb). But the shipped ClusterRole grants only get, patch on deployments/statefulsets/daemonsets (charts/ferrvault-operator/templates/clusterrole.yaml:20-22). So every rollout restart returns 403 Forbidden.
Verified: r.Update(ctx, obj) at sync.go:83; clusterrole apps verbs [get, patch] at line 22.
Impact
Auto-reload of consuming pods — a headline capability for a secret-sync operator — never works with the chart as shipped. The failure is only logged and discarded (see the swallowed-rollout-failure issue), so it's silent: users get rotated secrets that never take effect in running pods.
Fix
Switch triggerRollouts to a client.Patch (strategic-merge/JSON patch on the pod-template annotation — also avoids write conflicts on busy workloads), which the existing patch grant already allows. (Adding update to the ClusterRole would also work but Patch is the safer fix.)
Found during the 2026-08 FerrVault operator audit.
Problem
triggerRolloutspatches the pod-template restart annotation viar.Update(...)(internal/controller/ferrvaultsecret_sync.go:83), which issues an HTTP PUT (theupdateverb). But the shipped ClusterRole grants onlyget, patchondeployments/statefulsets/daemonsets(charts/ferrvault-operator/templates/clusterrole.yaml:20-22). So every rollout restart returns 403 Forbidden.Verified:
r.Update(ctx, obj)at sync.go:83; clusterrole apps verbs[get, patch]at line 22.Impact
Auto-reload of consuming pods — a headline capability for a secret-sync operator — never works with the chart as shipped. The failure is only logged and discarded (see the swallowed-rollout-failure issue), so it's silent: users get rotated secrets that never take effect in running pods.
Fix
Switch
triggerRolloutsto aclient.Patch(strategic-merge/JSON patch on the pod-template annotation — also avoids write conflicts on busy workloads), which the existingpatchgrant already allows. (Addingupdateto the ClusterRole would also work but Patch is the safer fix.)