From b3d8b13f39c028a5409fab46ef54f68c7c04d39e Mon Sep 17 00:00:00 2001
From: Brad Stein <Brad.Stein@gmail.com>
Date: Mon, 13 Apr 2026 03:32:25 -0300
Subject: [PATCH] maintenance(soteria): roll pvc-node pin fix and pod-read rbac

---
 services/maintenance/kustomization.yaml | 2 +-
 services/maintenance/soteria-rbac.yaml  | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/services/maintenance/kustomization.yaml b/services/maintenance/kustomization.yaml
index 77adec85..a1fafe82 100644
--- a/services/maintenance/kustomization.yaml
+++ b/services/maintenance/kustomization.yaml
@@ -51,7 +51,7 @@ images:
   - name: registry.bstein.dev/bstein/metis
     newTag: 0.1.0-9-amd64
   - name: registry.bstein.dev/bstein/soteria
-    newTag: 0.1.0-27 # {"$imagepolicy": "maintenance:soteria:tag"}
+    newTag: 0.1.0-29 # {"$imagepolicy": "maintenance:soteria:tag"}
 configMapGenerator:
   - name: disable-k3s-traefik-script
     namespace: maintenance
diff --git a/services/maintenance/soteria-rbac.yaml b/services/maintenance/soteria-rbac.yaml
index ebb9d831..5df1f8fb 100644
--- a/services/maintenance/soteria-rbac.yaml
+++ b/services/maintenance/soteria-rbac.yaml
@@ -7,6 +7,9 @@ rules:
   - apiGroups: [""]
     resources: ["persistentvolumeclaims", "persistentvolumes"]
     verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
   - apiGroups: [""]
     resources: ["secrets"]
     verbs: ["get", "list", "create", "update", "delete"]
@@ -26,4 +29,3 @@ subjects:
   - kind: ServiceAccount
     name: soteria
     namespace: maintenance
-