add resource-policy keep to cluster-scoped RBAC to avoid Helm ownership conflicts

Author: amirejaz

.github/workflows/test-helm-charts.yml

@@ -16,18 +16,6 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Install Taskfile
-        uses: arduino/setup-task@v1
-      
-      - name: Generate CRDs
-        run: task operator-manifests
-
-      - name: Debug CRDs in CI
-        run: |
-          echo "Listing CRD files in operator-crds/crd-files:"
-          ls -R deploy/charts/operator-crds/crd-files
-
-
       - name: Set up Helm
         uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
         with:

deploy/charts/operator/templates/clusterrole/role.yaml

@@ -3,6 +3,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: toolhive-operator-manager-role
+  annotations:
+    "helm.sh/resource-policy": keep
 rules:
 - apiGroups:
   - ""

deploy/charts/operator/templates/clusterrole/rolebinding.yaml

@@ -6,6 +6,8 @@ metadata:
   name: toolhive-operator-manager-rolebinding
   labels:
     {{- include "toolhive.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

deploy/charts/operator/templates/registry-api-clusterrole.yaml

@@ -1,6 +1,8 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
+  annotations:
+    "helm.sh/resource-policy": keep
   name: toolhive-registry-api-role
   labels:
     app.kubernetes.io/name: toolhive-registry-api

deploy/charts/operator/templates/registry-api-clusterrolebinding.yaml

@@ -6,6 +6,8 @@ metadata:
     app.kubernetes.io/name: toolhive-registry-api
     app.kubernetes.io/component: registry-api
     app.kubernetes.io/managed-by: toolhive-operator
+  annotations:
+    "helm.sh/resource-policy": keep
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole