From bddb97644acaeac5d805f5aabeb0331a6742572d Mon Sep 17 00:00:00 2001
From: Hristo Hristov <me@hhristov.info>
Date: Fri, 14 Aug 2026 12:27:25 +0300
Subject: [PATCH] fix(helm): fix manager.rbac.strict being no-op (#2084)

Signed-off-by: Hristo Hristov <me@hhristov.info>
---
 charts/capsule/README.md           | 1 +
 charts/capsule/templates/rbac.yaml | 2 +-
 charts/capsule/values.schema.json  | 4 ++++
 charts/capsule/values.yaml         | 4 ++++
 4 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/charts/capsule/README.md b/charts/capsule/README.md
index f4f1a0c9..ec42751e 100644
--- a/charts/capsule/README.md
+++ b/charts/capsule/README.md
@@ -170,6 +170,7 @@ The following Values have changed key or Value:
 | manager.rbac.create | bool | `true` | Specifies whether RBAC resources should be created. |
 | manager.rbac.existingClusterRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |
 | manager.rbac.existingRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |
+| manager.rbac.minimal | bool | `false` | DEPRECATED: use strict instead. Former name of the strict option; takes effect when either flag is true. |
 | manager.rbac.role.extraResources | list | `[]` | Extra namespaced RBAC PolicyRules to add to a Role created by this chart and bound to the Capsule ServiceAccount. |
 | manager.rbac.strict | bool | `false` | Strongly restrict the RBAC assigned to Capsule Controller. When set to true you must aggregate further permissions by yourself. |
 | manager.readinessProbe | object | `{"httpGet":{"path":"/readyz","port":10080}}` | Configure the readiness probe using Deployment probe spec |
diff --git a/charts/capsule/templates/rbac.yaml b/charts/capsule/templates/rbac.yaml
index a7b1d436..1ac0279c 100644
--- a/charts/capsule/templates/rbac.yaml
+++ b/charts/capsule/templates/rbac.yaml
@@ -106,7 +106,7 @@ subjects:
 - kind: ServiceAccount
   name: {{ include "capsule.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
-    {{- if $.Values.manager.rbac.minimal }}
+    {{- if or $.Values.manager.rbac.strict $.Values.manager.rbac.minimal }}
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
diff --git a/charts/capsule/values.schema.json b/charts/capsule/values.schema.json
index 6e5b32a6..97deb72f 100644
--- a/charts/capsule/values.schema.json
+++ b/charts/capsule/values.schema.json
@@ -693,6 +693,10 @@
                             "description": "Specifies further cluster roles to be added to the Capsule manager service account.",
                             "type": "array"
                         },
+                        "minimal": {
+                            "description": "DEPRECATED: use strict instead. Former name of the strict option; takes effect when either flag is true.",
+                            "type": "boolean"
+                        },
                         "role": {
                             "type": "object",
                             "properties": {
diff --git a/charts/capsule/values.yaml b/charts/capsule/values.yaml
index 816523b8..1698fd89 100644
--- a/charts/capsule/values.yaml
+++ b/charts/capsule/values.yaml
@@ -156,6 +156,10 @@ manager:
     # When set to true you must aggregate further permissions by yourself.
     strict: false
 
+    # -- DEPRECATED: use strict instead.
+    # Former name of the strict option; takes effect when either flag is true.
+    minimal: false
+
     # -- Specifies further cluster roles to be added to the Capsule manager service account.
     existingClusterRoles: []
     # - cluster-admin