The EventHorizon application rollout completed, but the Gitea autodeploy.yaml workflow failed during kubectl apply -k k8s because the eventhorizon-ci service account could not read the cluster-scoped static backup PersistentVolume or manage the namespaced PodDisruptionBudget.
The static PersistentVolume manifest also declared storageClassName: "". Kubernetes omits this field from the live bound PV, so every apply attempted a no-op patch. Granting CI write access to the PV would have been broader than required.
Repository merge feba4b667315 added an admin-applied, CI-excluded RBAC prerequisite:
eventhorizon-ci to get, list, watch, create, update, and patch PodDisruptionBudgets;get on the exact PV event-horizon-postgres-backups-nfs;The empty storageClassName was removed from the static PV manifest to match the API-normalized live object. The backup PVC retains its explicit empty storage class.
Canonical admin manifest: k8s/admin/eventhorizon-ci-apply-rbac.yaml. It is intentionally excluded from k8s/kustomization.yaml and must be applied by a cluster administrator.
kubectl apply --dry-run=server -k k8s passed;eventhorizon-ci can get only the named backup PV and cannot patch it;eventhorizon-ci can create and patch the EventHorizon PodDisruptionBudget in namespace event-horizon;cargo fmt --all -- --check: passed;cargo test --workspace: 300 backend and 5 frontend tests passed;Deploy manifests and Android distribution verification;gitea.app.lan/eventhorizon/eventhorizon:sha-feba4b667315;/healthz: ok;/readyz: Postgres and Qdrant ready;1.0.2351.Removing these grants would restore the prior workflow failure. If rollback is required, first remove the static PV and PodDisruptionBudget from the CI-managed kustomization or provide another administrator-owned reconciliation path; do not grant broad PV mutation rights to CI.