From 55363249628d87bee4784935e128f804c1e24fc1 Mon Sep 17 00:00:00 2001
From: Tanguille <91473554+Tanguille@users.noreply.github.com>
Date: Mon, 20 Jul 2026 22:04:25 +0200
Subject: [PATCH] fix(ci): restore runner os:admin so talosctl image pull works

os:operator (#4088) is rejected by the kubernetesTalosAPIAccess allowlist
(allowedRoles: os:admin, os:reader), so the runner never gets a valid
talosconfig. os:admin is the only allowlisted role that can pull images.
---
 .../actions-runner-controller/runners/cluster/rbac.yaml      | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/rbac.yaml b/kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/rbac.yaml
index e356ca79d7..1b6ee482b7 100644
--- a/kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/rbac.yaml
+++ b/kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/rbac.yaml
@@ -9,5 +9,6 @@ kind: ServiceAccount
 metadata:
   name: cluster-runner
 spec:
-  # Only use is 'talosctl image pull' in image-pull.yaml; ImagePull needs os:operator (not os:reader).
-  roles: ["os:operator"]
+  # Only use is 'talosctl image pull'; ImagePull needs more than os:reader, and the
+  # kubernetesTalosAPIAccess allowlist (talos/patches) permits only os:admin/os:reader.
+  roles: ["os:admin"]