operator: exempt stuck pods' claims from the PVCUnbinder pvc-rebinding gate

.changes/unreleased/operator-Fixed-20260712-pvcunbinder-gate3-own-claim.yaml

@@ -0,0 +1,23 @@
+project: operator
+kind: Fixed
+body: |-
+    The PVCUnbinder's pvc-rebinding gate (Gate 3) no longer defers on
+    unbound claims owned by Pods that are themselves stuck Pending on
+    the unbinder's scheduling-failure signature, the reconciled Pod
+    included. Counting them deadlocked clusters using
+    WaitForFirstConsumer binding — a stuck Pod's unbound claim can
+    never bind until the Pod schedules, the Pod can never schedule
+    until its mis-pinned sibling claim is unbound, and the gate
+    deferred exactly that unbind forever. A fresh cluster whose
+    broker's shadow-index-cache PV was provisioned onto an
+    already-occupied node never bootstrapped, with the unbinder logging
+    "a PVC in this cluster has no volumeName yet; deferring" every 30s;
+    the exemption is symmetric so multiple simultaneously mis-pinned
+    brokers cannot mutually deadlock either. Orphaned claims with no
+    Pod keep deferring the unbind, unbinder-initiated rebinds stay
+    serialized by the in-flight gate's uncached settle check, the
+    deferral log/Event now names the gating claim, and under the
+    deprecated --allow-pv-rebinding flag the original conservative
+    behavior (no exemption at all) is kept because freed Available PVs
+    make acting while any claim is unbound unsafe.
+time: 2026-07-12T15:23:50.000000+02:00

charts/redpanda/chart/files/pvcunbinder.ClusterRole.yaml

@@ -50,3 +50,11 @@ rules:
       - get
       - list
       - watch
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - storageclasses
+    verbs:
+      - get
+      - list
+      - watch

operator/chart/files/rbac/pvcunbinder.ClusterRole.yaml

@@ -50,3 +50,11 @@ rules:
       - get
       - list
       - watch
+  - apiGroups:
+      - storage.k8s.io
+    resources:
+      - storageclasses
+    verbs:
+      - get
+      - list
+      - watch