From aec5bc74ac06558250964391eab8c74e80825f1a Mon Sep 17 00:00:00 2001
From: wbsong111 <wbsong@paasup.io>
Date: Thu, 23 Apr 2026 14:15:58 +0900
Subject: [PATCH 1/8] Replace hardcoded resource names with Helm template
 helpers

---
 .../helm/flink-cdc-session/0.1.0/templates/_helpers.tpl    | 7 +++++++
 .../helm/flink-cdc-session/0.1.0/templates/configmap.yaml  | 2 +-
 .../flink-cdc-session/0.1.0/templates/flinkdeployment.yaml | 4 ++--
 manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml  | 4 ++--
 4 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/_helpers.tpl b/manifests/helm/flink-cdc-session/0.1.0/templates/_helpers.tpl
index b0648d8..51d25d3 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/templates/_helpers.tpl
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/_helpers.tpl
@@ -5,6 +5,13 @@ Chart label
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
+{{/*
+Fully qualified name: Release.Name (chart name 중복 시 제거)
+*/}}
+{{- define "flink-cdc-session.fullname" -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
 {{/*
 Common labels
 */}}
diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/configmap.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/configmap.yaml
index ff4073b..df70f9e 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/templates/configmap.yaml
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/configmap.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: cdc-pipeline-config
+  name:  {{ include "flink-cdc-session.fullname" . }}-pipeline-config
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "flink-cdc-session.labels" . | nindent 4 }}
diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml
index 2f2cc17..5fb3c75 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml
@@ -1,7 +1,7 @@
 apiVersion: flink.apache.org/v1beta1
 kind: FlinkDeployment
 metadata:
-  name: flink-cdc-session
+  name:  {{ include "flink-cdc-session.fullname" . }}-session
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "flink-cdc-session.labels" . | nindent 4 }}
@@ -90,7 +90,7 @@ spec:
       volumes:
         - name: pipeline-config
           configMap:
-            name: cdc-pipeline-config
+            name: {{ include "flink-cdc-session.fullname" . }}-pipeline-config
         {{- if .Values.truststore.enabled }}
         - name: truststore
           secret:
diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml
index f719712..3e97157 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml
@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ .Values.job.name }}
+  name:  {{ include "flink-cdc-session.fullname" . }}-{{ .Values.job.name }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "flink-cdc-session.labels" . | nindent 4 }}
@@ -65,7 +65,7 @@ spec:
       volumes:
         - name: pipeline-config
           configMap:
-            name: cdc-pipeline-config
+            name: {{ include "flink-cdc-session.fullname" . }}-pipeline-config
         {{- if .Values.truststore.enabled }}
         - name: truststore
           secret:

From 9c30bf0a80153c4bfc394239c1571a20381da273 Mon Sep 17 00:00:00 2001
From: wbsong111 <wbsong@paasup.io>
Date: Thu, 23 Apr 2026 14:22:02 +0900
Subject: [PATCH 2/8] Replace hardcoded resource names with Helm template
 helpers

---
 .../helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml | 2 +-
 manifests/helm/flink-cdc-session/0.1.0/templates/ingress.yaml   | 2 +-
 manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml       | 2 +-
 manifests/helm/flink-cdc-session/0.1.0/templates/secrets.yaml   | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml
index 5fb3c75..54085e9 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml
@@ -94,7 +94,7 @@ spec:
         {{- if .Values.truststore.enabled }}
         - name: truststore
           secret:
-            secretName: {{ .Values.truststore.secretName }}
+            secretName: {{ include "flink-cdc-session.fullname" . }}-flink-truststore
         {{- end }}
         {{- if eq .Values.checkpointStorage.storageType "gcs" }}
         - name: gcs-key
diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/ingress.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/ingress.yaml
index 2f1b85a..2b55940 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/templates/ingress.yaml
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/ingress.yaml
@@ -2,7 +2,7 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ .Release.Name }}
+  name: {{ include "flink-cdc-session.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "flink-cdc-session.labels" . | nindent 4 }}
diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml
index 3e97157..4756653 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml
@@ -69,7 +69,7 @@ spec:
         {{- if .Values.truststore.enabled }}
         - name: truststore
           secret:
-            secretName: {{ .Values.truststore.secretName }}
+            secretName: {{ include "flink-cdc-session.fullname" . }}-flink-truststore
         {{- end }}
         {{- if eq .Values.checkpointStorage.storageType "gcs" }}
         - name: gcs-key
diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/secrets.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/secrets.yaml
index f1f0d09..d0799f3 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/templates/secrets.yaml
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/secrets.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ .Values.truststore.secretName }}
+  name: {{ include "flink-cdc-session.fullname" . }}-flink-truststore
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "flink-cdc-session.labels" . | nindent 4 }}

From 502e7f8e2b38102837591561b10e2b47e3f2026f Mon Sep 17 00:00:00 2001
From: wbsong111 <wbsong@paasup.io>
Date: Thu, 23 Apr 2026 14:35:15 +0900
Subject: [PATCH 3/8] Replace hardcoded resource names with Helm template
 helpers

---
 manifests/helm/flink-cdc-session/0.1.0/templates/ingress.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/ingress.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/ingress.yaml
index 2b55940..2cc5152 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/templates/ingress.yaml
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/ingress.yaml
@@ -22,7 +22,7 @@ spec:
             pathType: ImplementationSpecific
             backend:
               service:
-                name: {{ .Release.Name }}-rest
+                name: {{ include "flink-cdc-session.fullname" . }}-session-rest
                 port:
                   number: 8081
   tls:

From ed0542e36d8fb3df2d8cabc4046612b52f4c8b8b Mon Sep 17 00:00:00 2001
From: wbsong111 <wbsong@paasup.io>
Date: Thu, 23 Apr 2026 16:23:37 +0900
Subject: [PATCH 4/8] Add service account and role/rolebinding

---
 manifests/helm/flink-cdc-job/0.1.0/README.md  | 53 +++++++++++++++----
 .../flink-cdc-job/0.1.0/custom-values.yaml    |  2 +-
 .../0.1.0/templates/_helpers.tpl              | 11 ++++
 .../flink-cdc-job/0.1.0/templates/job.yaml    |  2 +-
 .../flink-cdc-job/0.1.0/templates/role.yaml   | 16 ++++++
 .../0.1.0/templates/rolebinding.yaml          | 17 ++++++
 .../0.1.0/templates/serviceaccount.yaml       |  9 ++++
 .../helm/flink-cdc-job/0.1.0/values.yaml      |  7 ++-
 8 files changed, 105 insertions(+), 12 deletions(-)
 create mode 100644 manifests/helm/flink-cdc-job/0.1.0/templates/role.yaml
 create mode 100644 manifests/helm/flink-cdc-job/0.1.0/templates/rolebinding.yaml
 create mode 100644 manifests/helm/flink-cdc-job/0.1.0/templates/serviceaccount.yaml

diff --git a/manifests/helm/flink-cdc-job/0.1.0/README.md b/manifests/helm/flink-cdc-job/0.1.0/README.md
index 30c7690..e1acce5 100644
--- a/manifests/helm/flink-cdc-job/0.1.0/README.md
+++ b/manifests/helm/flink-cdc-job/0.1.0/README.md
@@ -24,8 +24,11 @@ flink-cdc-job/
 ├── values.yaml
 └── templates/
     ├── _helpers.tpl
-    ├── configmap.yaml   # 이 Job 전용 pipeline.yaml (Release.Name 기반 네이밍)
-    └── job.yaml         # Kubernetes Job
+    ├── configmap.yaml       # 이 Job 전용 pipeline.yaml (Release.Name 기반 네이밍)
+    ├── job.yaml             # Kubernetes Job
+    ├── serviceaccount.yaml  # ServiceAccount (serviceAccount.create: true 시 생성)
+    ├── role.yaml            # Role (rbac.create: true 시 생성)
+    └── rolebinding.yaml     # RoleBinding (rbac.create: true 시 생성)
 ```
 
 ## 배포
@@ -36,9 +39,11 @@ flink-cdc-job/
 helm install cdc-job ./flink/helm/flink-cdc-job -n flink-test
 ```
 
-Release 이름이 Job 및 ConfigMap 이름으로 사용됩니다.
+Release 이름이 Job, ConfigMap, ServiceAccount, Role 이름으로 사용됩니다.
 - Job: `cdc-job`
 - ConfigMap: `cdc-job-config`
+- ServiceAccount: `cdc-job`
+- Role / RoleBinding: `cdc-job`
 
 ### 여러 파이프라인 동시 배포
 
@@ -77,10 +82,29 @@ helm uninstall cdc-job -n flink-test
 
 | 파라미터 | 기본값 | 설명 |
 |----------|--------|------|
-| `image.repository` | `wbsong111/flink-cdc-pipeline` | 컨테이너 이미지 레지스트리/이름 |
+| `image.repository` | `paasup/flink-cdc-pipeline` | 컨테이너 이미지 레지스트리/이름 |
 | `image.tag` | `3.5.0-flink1.20-r1` | 이미지 태그 |
 | `image.pullPolicy` | `Always` | 이미지 풀 정책 |
-| `serviceAccount` | `flink` | Kubernetes ServiceAccount 이름 |
+
+### ServiceAccount
+
+| 파라미터 | 기본값 | 설명 |
+|----------|--------|------|
+| `serviceAccount.create` | `true` | ServiceAccount 생성 여부 |
+| `serviceAccount.name` | `""` | SA 이름. 비어있으면 Release.Name 사용 |
+
+### RBAC
+
+| 파라미터 | 기본값 | 설명 |
+|----------|--------|------|
+| `rbac.create` | `true` | Role / RoleBinding 생성 여부 |
+
+`rbac.create: true` 시 생성되는 Role 권한:
+
+| 리소스 | 권한 |
+|--------|------|
+| `configmaps` | `get`, `list` |
+| `pods` | `get`, `list` |
 
 ### Session Cluster 연결
 
@@ -89,8 +113,10 @@ helm uninstall cdc-job -n flink-test
 | `sessionCluster.restAddress` | `flink-cdc-session-rest` | Session Cluster REST 서비스명 |
 | `sessionCluster.restPort` | `8081` | REST 포트 |
 
-> `restAddress`는 FlinkDeployment 이름에 `-rest`를 붙인 값입니다.  
-> 예: FlinkDeployment `flink-cdc-session` → 서비스명 `flink-cdc-session-rest`
+> `restAddress`는 `flink-cdc-session` chart의 FlinkDeployment 이름에 `-rest`를 붙인 값입니다.  
+> `flink-cdc-session` chart는 FlinkDeployment를 `{release-name}-session`으로 생성하므로  
+> REST 서비스명은 `{release-name}-session-rest`가 됩니다.  
+> 예: release name `flink-cdc-session` → `sessionCluster.restAddress: flink-cdc-session-session-rest`
 
 ### Flink CDC 글로벌 설정
 
@@ -128,7 +154,7 @@ helm uninstall cdc-job -n flink-test
 | `sink.catalog.s3Endpoint` | `https://minio.example.org` | S3 호환 스토리지 엔드포인트 |
 | `sink.catalog.s3PathStyleAccess` | `"true"` | Path-style 접근 여부 |
 | `sink.catalog.oauth2Uri` | `https://keycloak.example.org/...` | OAuth2 토큰 엔드포인트 |
-| `sink.catalog.credential` | `lakekeeper-admin:...` | OAuth2 client_id:client_secret |
+| `sink.catalog.credential` | `lakekeeper-admin:...` | OAuth2 `client_id:client_secret` |
 | `sink.catalog.scope` | `lakekeeper` | OAuth2 scope |
 
 ### 라우팅
@@ -148,6 +174,9 @@ route:
 ### values-users.yaml (사용자/상품 테이블)
 
 ```yaml
+sessionCluster:
+  restAddress: flink-cdc-session-session-rest
+
 pipeline:
   name: cdc-users
   parallelism: 2
@@ -172,6 +201,9 @@ route:
 ### values-orders.yaml (주문 테이블)
 
 ```yaml
+sessionCluster:
+  restAddress: flink-cdc-session-session-rest
+
 pipeline:
   name: cdc-orders
   parallelism: 4
@@ -198,7 +230,7 @@ helm template cdc-job . -n flink-test
 
 helm lint .
 
-# 여러 release 이름으로 ConfigMap/Job 이름이 분리되는지 확인
+# 여러 release 이름으로 리소스 이름이 분리되는지 확인
 helm template cdc-users . -n flink-test | grep "name:"
 helm template cdc-orders . -n flink-test | grep "name:"
 ```
@@ -211,4 +243,7 @@ kubectl get job -n flink-test
 
 # Job 로그 확인
 kubectl logs -n flink-test job/cdc-job
+
+# Flink REST API로 Job 상태 확인
+kubectl exec -n flink-test <jobmanager-pod> -- curl -s http://localhost:8081/jobs
 ```
diff --git a/manifests/helm/flink-cdc-job/0.1.0/custom-values.yaml b/manifests/helm/flink-cdc-job/0.1.0/custom-values.yaml
index 32cb6a2..42b7fba 100644
--- a/manifests/helm/flink-cdc-job/0.1.0/custom-values.yaml
+++ b/manifests/helm/flink-cdc-job/0.1.0/custom-values.yaml
@@ -4,7 +4,7 @@
 
 # 제출 대상 Session Cluster (flink-cdc-session chart의 FlinkDeployment 이름 + "-rest")
 sessionCluster:
-  restAddress: flink-cdc-session-rest
+  restAddress: flink-cdc-session-session-rest
   restPort: 8081
 
 # PostgreSQL 소스 연결 정보
diff --git a/manifests/helm/flink-cdc-job/0.1.0/templates/_helpers.tpl b/manifests/helm/flink-cdc-job/0.1.0/templates/_helpers.tpl
index 5fc0033..f5e6e0f 100644
--- a/manifests/helm/flink-cdc-job/0.1.0/templates/_helpers.tpl
+++ b/manifests/helm/flink-cdc-job/0.1.0/templates/_helpers.tpl
@@ -12,6 +12,17 @@ Fully qualified name: Release.Name (chart name 중복 시 제거)
 {{- .Release.Name | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
+{{/*
+ServiceAccount name
+*/}}
+{{- define "flink-cdc-job.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "flink-cdc-job.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
 {{/*
 Common labels
 */}}
diff --git a/manifests/helm/flink-cdc-job/0.1.0/templates/job.yaml b/manifests/helm/flink-cdc-job/0.1.0/templates/job.yaml
index 1bfb0be..b383665 100644
--- a/manifests/helm/flink-cdc-job/0.1.0/templates/job.yaml
+++ b/manifests/helm/flink-cdc-job/0.1.0/templates/job.yaml
@@ -9,7 +9,7 @@ spec:
   backoffLimit: 0
   template:
     spec:
-      serviceAccountName: {{ .Values.serviceAccount }}
+      serviceAccountName: {{ include "flink-cdc-job.serviceAccountName" . }}
       containers:
         - name: submit
           image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
diff --git a/manifests/helm/flink-cdc-job/0.1.0/templates/role.yaml b/manifests/helm/flink-cdc-job/0.1.0/templates/role.yaml
new file mode 100644
index 0000000..7e34e34
--- /dev/null
+++ b/manifests/helm/flink-cdc-job/0.1.0/templates/role.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "flink-cdc-job.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-cdc-job.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+{{- end }}
diff --git a/manifests/helm/flink-cdc-job/0.1.0/templates/rolebinding.yaml b/manifests/helm/flink-cdc-job/0.1.0/templates/rolebinding.yaml
new file mode 100644
index 0000000..f8e9ef0
--- /dev/null
+++ b/manifests/helm/flink-cdc-job/0.1.0/templates/rolebinding.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "flink-cdc-job.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-cdc-job.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "flink-cdc-job.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "flink-cdc-job.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/manifests/helm/flink-cdc-job/0.1.0/templates/serviceaccount.yaml b/manifests/helm/flink-cdc-job/0.1.0/templates/serviceaccount.yaml
new file mode 100644
index 0000000..4a1eddc
--- /dev/null
+++ b/manifests/helm/flink-cdc-job/0.1.0/templates/serviceaccount.yaml
@@ -0,0 +1,9 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "flink-cdc-job.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-cdc-job.labels" . | nindent 4 }}
+{{- end }}
diff --git a/manifests/helm/flink-cdc-job/0.1.0/values.yaml b/manifests/helm/flink-cdc-job/0.1.0/values.yaml
index f396c39..10c4e00 100644
--- a/manifests/helm/flink-cdc-job/0.1.0/values.yaml
+++ b/manifests/helm/flink-cdc-job/0.1.0/values.yaml
@@ -3,7 +3,12 @@ image:
   tag: 3.5.0-flink1.20-r1
   pullPolicy: Always
 
-serviceAccount: flink
+serviceAccount:
+  create: true
+  name: ""  # defaults to fullname (release name) when empty
+
+rbac:
+  create: true
 
 # 제출 대상 Session Cluster REST 엔드포인트
 # flink-cdc-session chart가 생성한 서비스명: {FlinkDeployment.metadata.name}-rest

From d31a1fae18c6329dda53a83a84551f051f84bf95 Mon Sep 17 00:00:00 2001
From: wbsong111 <wbsong@paasup.io>
Date: Thu, 23 Apr 2026 16:30:38 +0900
Subject: [PATCH 5/8] Add service account and role/rolebinding

---
 .../helm/flink-cdc-session/0.1.0/README.md    | 103 +++++++++++++++---
 .../0.1.0/templates/_helpers.tpl              |  18 +++
 .../0.1.0/templates/flinkdeployment.yaml      |   4 +-
 .../0.1.0/templates/job.yaml                  |   4 +-
 .../0.1.0/templates/role.yaml                 |  25 +++++
 .../0.1.0/templates/rolebinding.yaml          |  17 +++
 .../0.1.0/templates/serviceaccount.yaml       |   9 ++
 .../helm/flink-cdc-session/0.1.0/values.yaml  |  11 +-
 8 files changed, 168 insertions(+), 23 deletions(-)
 create mode 100644 manifests/helm/flink-cdc-session/0.1.0/templates/role.yaml
 create mode 100644 manifests/helm/flink-cdc-session/0.1.0/templates/rolebinding.yaml
 create mode 100644 manifests/helm/flink-cdc-session/0.1.0/templates/serviceaccount.yaml

diff --git a/manifests/helm/flink-cdc-session/0.1.0/README.md b/manifests/helm/flink-cdc-session/0.1.0/README.md
index d19b2b3..169008e 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/README.md
+++ b/manifests/helm/flink-cdc-session/0.1.0/README.md
@@ -36,10 +36,28 @@ flink-cdc-session/
     ├── _helpers.tpl
     ├── configmap.yaml       # flink-cdc.yaml + pipeline.yaml
     ├── flinkdeployment.yaml # Flink Session Cluster
+    ├── ingress.yaml         # Ingress (조건부)
     ├── job.yaml             # CDC 파이프라인 제출 Job (조건부)
-    └── secrets.yaml         # truststore / gcs-key Secret (조건부)
+    ├── role.yaml            # Role (rbac.create: true 시 생성)
+    ├── rolebinding.yaml     # RoleBinding (rbac.create: true 시 생성)
+    ├── secrets.yaml         # truststore / gcs-key Secret (조건부)
+    └── serviceaccount.yaml  # ServiceAccount (serviceAccount.create: true 시 생성)
 ```
 
+## 리소스 명명 규칙
+
+모든 리소스 이름은 Helm Release 이름을 기반으로 동적 생성됩니다.
+
+| 리소스 | 이름 패턴 |
+| --- | --- |
+| FlinkDeployment | `{release-name}-session` |
+| ConfigMap | `{release-name}-pipeline-config` |
+| ServiceAccount | `{release-name}` |
+| Role / RoleBinding | `{release-name}` |
+| Truststore Secret (chart 생성 시) | `{release-name}-flink-truststore` |
+
+예: `helm install flink-cdc-session .` → FlinkDeployment 이름 `flink-cdc-session-session`
+
 ---
 
 ## 외부 JKS(truststore) 사용 여부 결정
@@ -62,7 +80,7 @@ Flink는 다음 엔드포인트와 HTTPS로 통신합니다.
 
 **`truststore.enabled: false` (외부 JKS 불필요)**  
 → 모든 엔드포인트가 **공인 CA**(Let's Encrypt, DigiCert 등)로 서명된 인증서를 사용하는 경우  
-→ JVM 기본 cacerts만으로 TLS 검증이 가능하며, `flink-truststore` Secret도 불필요
+→ JVM 기본 cacerts만으로 TLS 검증이 가능하며, truststore Secret도 불필요
 
 > **왜 외부 JKS가 필요한가**  
 > Flink JVM 옵션 `-Djavax.net.ssl.trustStore`는 JVM 기본 cacerts를 **완전히 교체**합니다.  
@@ -113,7 +131,7 @@ kubectl run ssl-check --rm -it --image=alpine/openssl --restart=Never -- \
 Docker 이미지 내부의 JVM cacerts를 truststore 베이스로 사용합니다.
 
 ```bash
-IMAGE="wbsong111/flink-cdc-pipeline:3.5.0-flink1.20-r1"
+IMAGE="paasup/flink-cdc-pipeline:3.5.0-flink1.20-r1"
 
 docker run --rm --entrypoint="" "${IMAGE}" \
   cat /opt/java/openjdk/lib/security/cacerts > truststore.jks
@@ -164,7 +182,16 @@ curl -v --cacert /tmp/internal-ca.pem https://lakekeeper.example.org/catalog 2>&
 
 #### Step 4 — Kubernetes Secret 생성
 
+chart가 자동 생성하는 Secret 이름은 `{release-name}-flink-truststore`입니다.  
+기존 Secret을 재사용하려면 `truststore.secretName`에 이름을 지정합니다.
+
 ```bash
+# chart 명명 규칙에 맞게 생성 (release name: flink-cdc-session)
+kubectl create secret generic flink-cdc-session-flink-truststore \
+  --from-file=truststore.jks=./truststore.jks \
+  -n flink-test
+
+# 또는 기존 Secret 이름 그대로 사용 (custom-values.yaml에서 secretName 지정)
 kubectl create secret generic flink-truststore \
   --from-file=truststore.jks=./truststore.jks \
   -n flink-test
@@ -173,7 +200,7 @@ kubectl create secret generic flink-truststore \
 기존 Secret 업데이트:
 
 ```bash
-kubectl create secret generic flink-truststore \
+kubectl create secret generic flink-cdc-session-flink-truststore \
   --from-file=truststore.jks=./truststore.jks \
   -n flink-test \
   --dry-run=client -o yaml | kubectl apply -f -
@@ -188,7 +215,7 @@ kubectl create secret generic flink-truststore \
 
 ```bash
 # truststore.jks가 Pod에 정상 마운트되었는지 확인
-kubectl exec -n flink-test deploy/flink-cdc-session -- ls -la /opt/flink/certs/
+kubectl exec -n flink-test deploy/flink-cdc-session-session -- ls -la /opt/flink/certs/
 
 # JVM이 truststore를 인식하는지 확인 (JobManager 로그에서 SSL 관련 출력)
 kubectl logs -n flink-test -l component=jobmanager | grep -i "truststore\|ssl\|tls" | head -20
@@ -268,7 +295,7 @@ helm install flink-cdc-session ./flink/helm/flink-cdc-session \
   -f values.yaml \
   -f custom-values.yaml
 
-# 2단계: Cluster 기동 확인
+# 2단계: Cluster 기동 확인 (LIFECYCLE STATE가 STABLE이 될 때까지 대기)
 kubectl get flinkdeployment -n flink-test -w
 
 # 3단계: Job 포함해서 업그레이드
@@ -279,6 +306,17 @@ helm upgrade flink-cdc-session ./flink/helm/flink-cdc-session \
   --set job.enabled=true
 ```
 
+### 기존 truststore Secret 재사용
+
+네임스페이스에 이미 truststore Secret이 있는 경우 `truststore.secretName`으로 지정합니다.
+
+```yaml
+# custom-values.yaml
+truststore:
+  enabled: true
+  secretName: flink-truststore  # 기존 Secret 이름
+```
+
 ### truststore 불필요한 경우 (공인 CA 환경)
 
 ```bash
@@ -296,7 +334,7 @@ helm install flink-cdc-session ./flink/helm/flink-cdc-session \
 ### Secret도 chart에서 생성하는 경우
 
 ```bash
-# truststore Secret chart 생성
+# truststore Secret chart 생성 (이름: {release-name}-flink-truststore)
 helm install flink-cdc-session ./flink/helm/flink-cdc-session \
   -n flink-test \
   --set truststore.create=true \
@@ -324,16 +362,39 @@ helm uninstall flink-cdc-session -n flink-test
 
 | 파라미터 | 기본값 | 설명 |
 |----------|--------|------|
-| `image.repository` | `wbsong111/flink-cdc-pipeline` | 컨테이너 이미지 저장소 |
+| `image.repository` | `paasup/flink-cdc-pipeline` | 컨테이너 이미지 저장소 |
 | `image.tag` | `3.5.0-flink1.20-r1` | 이미지 태그 |
 | `image.pullPolicy` | `Always` | 이미지 풀 정책 |
 
+### ServiceAccount
+
+| 파라미터 | 기본값 | 설명 |
+| --- | --- | --- |
+| `serviceAccount.create` | `true` | ServiceAccount 생성 여부 |
+| `serviceAccount.name` | `""` | SA 이름. 비어있으면 Release.Name 사용 |
+
+### RBAC
+
+| 파라미터 | 기본값 | 설명 |
+| --- | --- | --- |
+| `rbac.create` | `true` | Role / RoleBinding 생성 여부 |
+
+`rbac.create: true` 시 생성되는 Role 권한:
+
+| 리소스 | 권한 |
+| --- | --- |
+| `pods` | `get`, `list`, `watch`, `create`, `delete`, `patch` |
+| `configmaps` | `get`, `list`, `watch`, `create`, `update`, `patch`, `delete` |
+| `services` | `get`, `list`, `create`, `delete` |
+| `events` | `create`, `patch` |
+| `apps/deployments` | `get`, `list`, `watch`, `create`, `update`, `patch`, `delete` |
+| `apps/replicasets` | `get`, `list`, `watch`, `create`, `update`, `patch`, `delete` |
+
 ### Flink 클러스터
 
 | 파라미터 | 기본값 | 설명 |
 |----------|--------|------|
 | `flinkVersion` | `v1_20` | Flink 버전 |
-| `serviceAccount` | `flink` | Pod 서비스 어카운트 |
 | `jobManager.replicas` | `1` | JobManager 인스턴스 수 |
 | `jobManager.memory` | `1024m` | JobManager 메모리 |
 | `jobManager.cpu` | `0.5` | JobManager CPU |
@@ -372,8 +433,8 @@ helm uninstall flink-cdc-session -n flink-test
 
 | 파라미터 | 기본값 | 설명 |
 |----------|--------|------|
-| `truststore.enabled` | `true` | 외부 JKS 사용 여부. 사설 CA 환경이면 `true` |
-| `truststore.secretName` | `flink-truststore` | truststore Secret 이름 |
+| `truststore.enabled` | `false` | 외부 JKS 사용 여부. 사설 CA 환경이면 `true` |
+| `truststore.secretName` | `""` | 기존 Secret 이름 지정. 비어있으면 `{release-name}-flink-truststore` 사용 |
 | `truststore.password` | `changeit` | JKS 패스워드 |
 | `truststore.create` | `false` | `true`이면 chart가 Secret 생성 |
 | `truststore.base64jks` | `""` | `create: true` 시 필수, base64 인코딩된 .jks |
@@ -427,11 +488,16 @@ route:
 | 파라미터 | 기본값 | 설명 |
 |----------|--------|------|
 | `job.enabled` | `true` | `false`이면 Job 리소스 미생성 |
-| `job.name` | `submit-cdc` | Job 리소스 이름 |
+| `job.name` | `submit-cdc` | Job 이름 suffix. 전체 이름: `{release-name}-{job.name}` |
 | `job.restAddress` | `flink-cdc-session-rest` | Session Cluster REST 서비스명 |
 | `job.restPort` | `8081` | REST 포트 |
 | `job.pipelineFile` | `./conf/pipeline.yaml` | 파이프라인 설정 파일 경로 |
 
+> `job.restAddress`는 FlinkDeployment 이름에 `-rest`를 붙인 값입니다.  
+> 이 chart가 생성하는 FlinkDeployment 이름은 `{release-name}-session`이므로  
+> REST 서비스명은 `{release-name}-session-rest`가 됩니다.  
+> 예: release name `flink-cdc-session` → `job.restAddress: flink-cdc-session-session-rest`
+
 ---
 
 ## 렌더링 확인
@@ -458,14 +524,19 @@ helm template flink-cdc-session . -n flink-test \
 ## 배포 후 확인
 
 ```bash
-# Session Cluster 상태 확인
+# Session Cluster 상태 확인 (release name: flink-cdc-session)
 kubectl get flinkdeployment -n flink-test
+# NAME                        JOB STATUS   LIFECYCLE STATE
+# flink-cdc-session-session                STABLE
 
-# Job 로그 확인
-kubectl logs -n flink-test job/submit-cdc
+# JobManager 로그 확인
+kubectl logs -n flink-test -l app.kubernetes.io/instance=flink-cdc-session
+
+# Flink REST API로 Job 상태 확인
+kubectl exec -n flink-test <jobmanager-pod> -- curl -s http://localhost:8081/jobs
 
 # Job 삭제 후 재제출
-kubectl delete job submit-cdc -n flink-test
+kubectl delete job flink-cdc-session-submit-cdc -n flink-test
 helm upgrade flink-cdc-session . -n flink-test \
   -f values.yaml -f custom-values.yaml \
   --set job.enabled=true
diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/_helpers.tpl b/manifests/helm/flink-cdc-session/0.1.0/templates/_helpers.tpl
index 51d25d3..fbfd8b8 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/templates/_helpers.tpl
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/_helpers.tpl
@@ -12,6 +12,24 @@ Fully qualified name: Release.Name (chart name 중복 시 제거)
 {{- .Release.Name | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
+{{/*
+ServiceAccount name
+*/}}
+{{- define "flink-cdc-session.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "flink-cdc-session.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Truststore secret name
+*/}}
+{{- define "flink-cdc-session.truststoreSecretName" -}}
+{{- default (printf "%s-flink-truststore" (include "flink-cdc-session.fullname" .)) .Values.truststore.secretName }}
+{{- end }}
+
 {{/*
 Common labels
 */}}
diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml
index 54085e9..53fd769 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml
@@ -33,7 +33,7 @@ spec:
       -Djavax.net.ssl.trustStorePassword={{ .Values.truststore.password }}
       -Djavax.net.ssl.trustStoreType=JKS
     {{- end }}
-  serviceAccount: {{ .Values.serviceAccount }}
+  serviceAccount: {{ include "flink-cdc-session.serviceAccountName" . }}
   jobManager:
     replicas: {{ .Values.jobManager.replicas }}
     resource:
@@ -94,7 +94,7 @@ spec:
         {{- if .Values.truststore.enabled }}
         - name: truststore
           secret:
-            secretName: {{ include "flink-cdc-session.fullname" . }}-flink-truststore
+            secretName: {{ include "flink-cdc-session.truststoreSecretName" . }}
         {{- end }}
         {{- if eq .Values.checkpointStorage.storageType "gcs" }}
         - name: gcs-key
diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml
index 4756653..4afbb84 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml
@@ -10,7 +10,7 @@ spec:
   backoffLimit: 0
   template:
     spec:
-      serviceAccountName: {{ .Values.serviceAccount }}
+      serviceAccountName: {{ include "flink-cdc-session.serviceAccountName" . }}
       containers:
         - name: submit
           image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
@@ -69,7 +69,7 @@ spec:
         {{- if .Values.truststore.enabled }}
         - name: truststore
           secret:
-            secretName: {{ include "flink-cdc-session.fullname" . }}-flink-truststore
+            secretName: {{ include "flink-cdc-session.truststoreSecretName" . }}
         {{- end }}
         {{- if eq .Values.checkpointStorage.storageType "gcs" }}
         - name: gcs-key
diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/role.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/role.yaml
new file mode 100644
index 0000000..8cffe9b
--- /dev/null
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/role.yaml
@@ -0,0 +1,25 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "flink-cdc-session.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-cdc-session.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch", "create", "delete", "patch"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["get", "list", "create", "delete"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "replicasets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+{{- end }}
diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/rolebinding.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/rolebinding.yaml
new file mode 100644
index 0000000..3a1f25a
--- /dev/null
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/rolebinding.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "flink-cdc-session.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-cdc-session.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "flink-cdc-session.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "flink-cdc-session.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/manifests/helm/flink-cdc-session/0.1.0/templates/serviceaccount.yaml b/manifests/helm/flink-cdc-session/0.1.0/templates/serviceaccount.yaml
new file mode 100644
index 0000000..da2fcbd
--- /dev/null
+++ b/manifests/helm/flink-cdc-session/0.1.0/templates/serviceaccount.yaml
@@ -0,0 +1,9 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "flink-cdc-session.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-cdc-session.labels" . | nindent 4 }}
+{{- end }}
diff --git a/manifests/helm/flink-cdc-session/0.1.0/values.yaml b/manifests/helm/flink-cdc-session/0.1.0/values.yaml
index 6d76f5f..6aa4f2f 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/values.yaml
+++ b/manifests/helm/flink-cdc-session/0.1.0/values.yaml
@@ -4,7 +4,12 @@ image:
   pullPolicy: Always
 
 flinkVersion: v1_20
-serviceAccount: flink
+serviceAccount:
+  create: true
+  name: ""  # defaults to fullname (release name) when empty
+
+rbac:
+  create: true
 
 ingress:
   enabled: false
@@ -64,10 +69,10 @@ truststore:
   # enabled: true  → 외부 JKS를 사용. 싱크/소스 엔드포인트가 사설 CA 인증서를 사용할 때 필요.
   # enabled: false → 외부 JKS 미사용. 모든 엔드포인트가 공인 CA 인증서를 사용할 때 설정.
   #                  JVM 기본 cacerts로 TLS 검증을 수행하며, truststore Secret도 불필요.
-  enabled: true
-  secretName: flink-truststore
+  enabled: false
   password: changeit
   create: false
+  secretName: ""  # 기존 Secret 이름 지정 시 사용. 비어있으면 <fullname>-flink-truststore 사용
   # create: true 시 필요: base64 인코딩된 truststore.jks 파일 내용
   # base64jks: ""
 

From 8e68b1d60318c2aab182ab3b0469ced35f461172 Mon Sep 17 00:00:00 2001
From: wbsong111 <wbsong@paasup.io>
Date: Thu, 23 Apr 2026 16:32:52 +0900
Subject: [PATCH 6/8] Update CUSTOM-README.md

---
 .../flink-cdc-session/0.1.0/CUSTOM-README.md  | 36 ++++++++++++-------
 1 file changed, 24 insertions(+), 12 deletions(-)

diff --git a/manifests/helm/flink-cdc-session/0.1.0/CUSTOM-README.md b/manifests/helm/flink-cdc-session/0.1.0/CUSTOM-README.md
index 3c4d647..3166c90 100644
--- a/manifests/helm/flink-cdc-session/0.1.0/CUSTOM-README.md
+++ b/manifests/helm/flink-cdc-session/0.1.0/CUSTOM-README.md
@@ -33,7 +33,17 @@ helm upgrade flink-cdc-session ./ \
 
 ## 2. custom-values.yaml 설명
 
-### 1) 체크포인트 저장소
+### 1) ServiceAccount / RBAC
+
+| Name | 설명 | 기본값 |
+|------|------|--------|
+| `serviceAccount.create` | ServiceAccount 생성 여부 | `true` |
+| `serviceAccount.name` | SA 이름. 비어있으면 Release.Name 사용 | `""` |
+| `rbac.create` | Role / RoleBinding 생성 여부 | `true` |
+
+> `rbac.create: true` 시 JobManager가 TaskManager(Deployment)를 관리하기 위한 RBAC 권한이 함께 생성됩니다.
+
+### 2) 체크포인트 저장소
 
 | Name | 설명 | 기본값 |
 |------|------|--------|
@@ -44,7 +54,7 @@ helm upgrade flink-cdc-session ./ \
 | `checkpointStorage.s3.pathStyleAccess` | Path-style 접근 여부 (MinIO는 `"true"`) | `"true"` |
 | `checkpointStorage.s3.existingSecret` | 자격증명 Secret 이름 | `minio-credentials` |
 
-### 2) Ingress 설정
+### 3) Ingress 설정
 
 | Name | 설명 | 기본값 |
 |------|------|--------|
@@ -53,14 +63,16 @@ helm upgrade flink-cdc-session ./ \
 | `ingress.className` | IngressClass 이름 | `kong` |
 | `ingress.annotations` | Ingress 어노테이션 | cert-manager + Kong HTTPS 설정 |
 
-### 3) Truststore (사설 CA 환경)
+### 4) Truststore (사설 CA 환경)
 
 | Name | 설명 | 기본값 |
-|------|------|--------|
+| --- | --- | --- |
 | `truststore.enabled` | 외부 JKS 사용 여부 | `true` |
-| `truststore.secretName` | truststore Secret 이름 | `flink-truststore` |
+| `truststore.secretName` | 기존 Secret 이름 지정. 비어있으면 `{release-name}-flink-truststore` 자동 사용 | `""` |
 
-### 4) Job 설정
+> `truststore.secretName: flink-truststore` 처럼 기존 Secret을 지정하면 chart가 Secret을 새로 생성하지 않고 재사용합니다.
+
+### 5) Job 설정
 
 | Name | 설명 | 기본값 |
 |------|------|--------|
@@ -68,7 +80,7 @@ helm upgrade flink-cdc-session ./ \
 
 > **주의**: Session Cluster가 RUNNING 상태가 된 후 `job.enabled: true`로 upgrade하세요.
 
-### 5) Flink 클러스터 리소스 (values.yaml에서 조정)
+### 6) Flink 클러스터 리소스 (values.yaml에서 조정)
 
 | Name | 설명 | 기본값 |
 |------|------|--------|
@@ -79,7 +91,7 @@ helm upgrade flink-cdc-session ./ \
 | `taskManager.cpu` | TaskManager CPU | `1` |
 | `taskManager.taskSlots` | TaskManager 슬롯 수 | `2` |
 
-### 6) PostgreSQL 소스 (values.yaml에서 조정)
+### 7) PostgreSQL 소스 (values.yaml에서 조정)
 
 | Name | 설명 | 기본값 |
 |------|------|--------|
@@ -90,7 +102,7 @@ helm upgrade flink-cdc-session ./ \
 | `postgres.slotName` | Replication slot 이름 | `flink_cdc_slot` |
 | `postgres.tables` | CDC 대상 테이블 목록 | `testdb.public.orders,testdb.public.users` |
 
-### 7) Iceberg 싱크 (values.yaml에서 조정)
+### 8) Iceberg 싱크 (values.yaml에서 조정)
 
 | Name | 설명 | 기본값 |
 |------|------|--------|
@@ -147,11 +159,11 @@ kubectl get flinkdeployment -n flink-test
 # Pod 상태 확인
 kubectl get pods -n flink-test
 
-# Job 로그 확인
-kubectl logs -n flink-test job/submit-cdc
+# Job 로그 확인 (release name: flink-cdc-session, job.name: submit-cdc)
+kubectl logs -n flink-test job/flink-cdc-session-submit-cdc
 
 # Flink Web UI (포트포워딩)
-kubectl port-forward svc/flink-cdc-session-rest 8081:8081 -n flink-test
+kubectl port-forward svc/flink-cdc-session-session-rest 8081:8081 -n flink-test
 ```
 
 ## 5. 삭제

From ba0a4b19bcfcdd28ce728e0f2858d4077e940dd7 Mon Sep 17 00:00:00 2001
From: wbsong111 <wbsong@paasup.io>
Date: Thu, 23 Apr 2026 16:34:40 +0900
Subject: [PATCH 7/8] Update CUSTOM-README.md

---
 .../helm/flink-cdc-job/0.1.0/CUSTOM-README.md | 34 +++++++++++++++----
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/manifests/helm/flink-cdc-job/0.1.0/CUSTOM-README.md b/manifests/helm/flink-cdc-job/0.1.0/CUSTOM-README.md
index 9b80852..15c7555 100644
--- a/manifests/helm/flink-cdc-job/0.1.0/CUSTOM-README.md
+++ b/manifests/helm/flink-cdc-job/0.1.0/CUSTOM-README.md
@@ -7,7 +7,7 @@ Session Cluster를 재시작하지 않고 파이프라인만 독립적으로 배
 
 ## 1. 배포 방법
 
-Release 이름이 Job 및 ConfigMap 이름으로 사용됩니다.
+Release 이름이 Job, ConfigMap, ServiceAccount, Role 이름으로 사용됩니다.
 
 ```sh
 helm upgrade --install cdc-job ./ \
@@ -37,17 +37,27 @@ helm install cdc-job ./ -n flink-test -f values.yaml -f custom-values.yaml
 
 ## 2. custom-values.yaml 설명
 
-### 1) Session Cluster 연결
+### 1) ServiceAccount / RBAC
 
 | Name | 설명 | 기본값 |
 |------|------|--------|
-| `sessionCluster.restAddress` | Session Cluster REST 서비스명 | `flink-cdc-session-rest` |
+| `serviceAccount.create` | ServiceAccount 생성 여부 | `true` |
+| `serviceAccount.name` | SA 이름. 비어있으면 Release.Name 사용 | `""` |
+| `rbac.create` | Role / RoleBinding 생성 여부 | `true` |
+
+### 2) Session Cluster 연결
+
+| Name | 설명 | 기본값 |
+| --- | --- | --- |
+| `sessionCluster.restAddress` | Session Cluster REST 서비스명 | `flink-cdc-session-session-rest` |
 | `sessionCluster.restPort` | REST 포트 | `8081` |
 
 > `restAddress`는 FlinkDeployment 이름에 `-rest`를 붙인 값입니다.  
-> 예: FlinkDeployment `flink-cdc-session` → 서비스명 `flink-cdc-session-rest`
+> `flink-cdc-session` chart는 FlinkDeployment를 `{release-name}-session`으로 생성하므로  
+> REST 서비스명은 `{release-name}-session-rest`가 됩니다.  
+> 예: release name `flink-cdc-session` → `sessionCluster.restAddress: flink-cdc-session-session-rest`
 
-### 2) PostgreSQL 소스
+### 3) PostgreSQL 소스
 
 | Name | 설명 | 기본값 |
 |------|------|--------|
@@ -92,6 +102,9 @@ route:
 ### values-users.yaml (사용자/상품 테이블)
 
 ```yaml
+sessionCluster:
+  restAddress: flink-cdc-session-session-rest
+
 pipeline:
   name: cdc-users
   parallelism: 2
@@ -116,6 +129,9 @@ route:
 ### values-orders.yaml (주문 테이블)
 
 ```yaml
+sessionCluster:
+  restAddress: flink-cdc-session-session-rest
+
 pipeline:
   name: cdc-orders
   parallelism: 4
@@ -139,8 +155,11 @@ route:
 # Job 상태 확인
 kubectl get job -n flink-test
 
-# Job 로그 확인
+# Job 로그 확인 (release name: cdc-job)
 kubectl logs -n flink-test job/cdc-job
+
+# Flink REST API로 Job 상태 확인
+kubectl exec -n flink-test <jobmanager-pod> -- curl -s http://localhost:8081/jobs
 ```
 
 ## 5. 삭제
@@ -148,7 +167,8 @@ kubectl logs -n flink-test job/cdc-job
 ```bash
 helm uninstall cdc-job -n flink-test
 ```
-> **삭제 시 주의사항** : `cdc-job`을 삭제하여도 flink session cluster에 제출된 job은 삭제되지 않습니다.
+
+> **삭제 시 주의사항**: `cdc-job`을 삭제하여도 Flink Session Cluster에 제출된 Job은 삭제되지 않습니다.
 
 ## 6. 참고
 

From e6787756721016f3b2140164a13d4715f8794133 Mon Sep 17 00:00:00 2001
From: wbsong111 <wbsong@paasup.io>
Date: Fri, 24 Apr 2026 09:59:57 +0900
Subject: [PATCH 8/8] Update README.md

---
 manifests/helm/mlflow/1.9.0/README.md | 53 +++++++++++++++++----------
 1 file changed, 33 insertions(+), 20 deletions(-)

diff --git a/manifests/helm/mlflow/1.9.0/README.md b/manifests/helm/mlflow/1.9.0/README.md
index 364e973..abd1f6d 100644
--- a/manifests/helm/mlflow/1.9.0/README.md
+++ b/manifests/helm/mlflow/1.9.0/README.md
@@ -1,7 +1,7 @@
 # MLflow 배포 (OIDC Auth)
 
-MLflow 3.11.1 + mlflow-oidc-auth v7.0.3를 Keycloak과 연동하여 배포하는 가이드이다.
-커스텀 이미지 `wbsong111/mlflow:v3.11.1-oidc`에 OIDC 플러그인이 포함되어 있다.
+MLflow 3.11.1 + mlflow-oidc-auth를 Keycloak과 연동하여 배포하는 가이드이다.
+커스텀 이미지 `paasup/mlflow:v3.11.1-oidc`에 OIDC 플러그인이 포함되어 있다.
 
 ---
 
@@ -82,13 +82,13 @@ git clone https://github.com/paasup/dip-catalog.git
 cd dip-catalog
 
 # 신규 설치
-helm install mlflow manifests/helm/mlflow/1.8.1/ \
-  -f manifests/helm/mlflow/1.8.1/custom-values.yaml \
+helm install mlflow manifests/helm/mlflow/1.9.0/ \
+  -f manifests/helm/mlflow/1.9.0/custom-values.yaml \
   -n mlflow --create-namespace
 
 # 업그레이드
-helm upgrade mlflow manifests/helm/mlflow/1.8.1/ \
-  -f manifests/helm/mlflow/1.8.1/custom-values.yaml \
+helm upgrade mlflow manifests/helm/mlflow/1.9.0/ \
+  -f manifests/helm/mlflow/1.9.0/custom-values.yaml \
   -n mlflow
 ```
 
@@ -102,12 +102,12 @@ OIDC 플러그인이 포함된 커스텀 이미지를 사용한다.
 
 ```yaml
 image:
-  repository: wbsong111/mlflow
+  repository: paasup/mlflow
   tag: "v3.11.1-oidc"
 
 initImages:
   mlflowDbMigration:
-    repository: wbsong111/mlflow
+    repository: paasup/mlflow
     tag: "v3.11.1-oidc"
 ```
 
@@ -132,15 +132,6 @@ extraEnvVars:
   OIDC_ALEMBIC_VERSION_TABLE: "mlflow_oidc_alembic_version"
 ```
 
-**주의사항**
-
-| 항목 | 올바른 값 | 잘못된 값 | 이유 |
-|------|-----------|-----------|------|
-| `SSL_CERT_FILE` | `SSL_CERT_FILE` | `REQUESTS_CA_BUNDLE` | mlflow-oidc-auth는 httpx를 사용하며 httpx는 `SSL_CERT_FILE` 환경변수를 인식 |
-| `OIDC_SCOPE` | `"openid email profile"` | `"openid,email,profile"` | OAuth2 RFC 6749 표준: 스코프는 공백으로 구분 |
-| `OIDC_REDIRECT_URI` | `.../callback` | `.../oidc/callback` | mlflow-oidc-auth auth_router에 prefix가 없어 실제 경로는 `/callback` |
-| `OIDC_ALEMBIC_VERSION_TABLE` | `"mlflow_oidc_alembic_version"` | 기본값(`alembic_version`) | MLflow와 mlflow-oidc-auth가 동일한 alembic_version 테이블을 사용하면 마이그레이션 충돌 발생 |
-
 ---
 
 ### 3.3 OIDC App 활성화
@@ -186,7 +177,29 @@ extraVolumeMounts:
 
 ---
 
-### 3.6 Ingress 설정
+### 3.6 OIDC Auth Middleware 패치
+
+`mlflow-oidc-auth` 플러그인의 `auth_middleware.py`를 차트에 포함된 버전으로 교체한다.
+워크스페이스 지원(`x-mlflow-workspace` 헤더 처리) 등 업스트림 수정 사항을 반영한다.
+
+```yaml
+oidcAuthPatch:
+  enabled: true
+  mountPath: "/usr/local/lib/python3.11/site-packages/mlflow_oidc_auth/middleware/auth_middleware.py"
+```
+
+파일 소스: `files/auth_middleware.py`
+
+> **Python 버전 확인**: 컨테이너 이미지의 Python 버전이 다를 경우 `mountPath`를 수정한다.
+>
+> ```sh
+> kubectl exec -n mlflow <pod> -- python -c \
+>   "import mlflow_oidc_auth.middleware.auth_middleware as m; print(m.__file__)"
+> ```
+
+---
+
+### 3.7 Ingress 설정
 
 ```yaml
 ingress:
@@ -211,7 +224,7 @@ ingress:
 
 ---
 
-### 3.7 PostgreSQL 설정
+### 3.8 PostgreSQL 설정
 
 내장 PostgreSQL을 사용한다.
 
@@ -238,7 +251,7 @@ extraEnvVars:
 
 ---
 
-### 3.8 S3 (MinIO) 설정
+### 3.9 S3 (MinIO) 설정
 
 ```yaml
 artifactRoot: