From 0e5e76afaa8447382f2b15b412dba577e12e85ad Mon Sep 17 00:00:00 2001
From: NekoPunch <engineer.jyao@gmail.com>
Date: Sun, 2 Aug 2026 02:42:48 -0700
Subject: [PATCH] fix(dev-infra): always re-apply CRDs and RBAC on system
 deploy

ensure_crds skips the generated manifests once the CRDs exist, so an
upgrade never refreshed CRD schemas or ClusterRoles; a controller
needing a new permission deadlocked on informer start while the
rollout reported success. Fixes #697.
---
 hack/install-ate.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hack/install-ate.sh b/hack/install-ate.sh
index d7eafb457..49c61d827 100755
--- a/hack/install-ate.sh
+++ b/hack/install-ate.sh
@@ -327,7 +327,9 @@ deploy_crds() {
 
 deploy_ate_system() {
   log_step "deploy_ate_system"
-  ensure_crds
+  # Not ensure_crds: its existence check skips upgrades, stranding stale CRD
+  # schemas and RBAC (role.yaml has no other apply path).
+  deploy_crds
 
   # Enforce per-class SandboxConfig asset requirements (applied before any
   # SandboxConfig so the defaults below are validated too).