@@ -112,15 +112,7 @@ metadata:
   annotations:
     "helm.sh/hook": pre-delete
     "helm.sh/hook-weight": "0"
-    # Matches the Job's policy deliberately. The Job carries no hook-succeeded:
-    # it outlives the run so the degraded path leaves a readable record, and
-    # ttlSecondsAfterFinished reclaims it. Reaping the ServiceAccount, Role or
-    # RoleBinding on hook-succeeded or hook-failed would leave that Job able to
-    # start a pod whose ServiceAccount no longer exists: kubelet then mounts the
-    # projected volume without a token, kubectl finds no in-cluster config and
-    # falls back to localhost:8080, and the pre-delete hook fails every uninstall
-    # from then on.
-    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -131,15 +123,7 @@ metadata:
   annotations:
     "helm.sh/hook": pre-delete
     "helm.sh/hook-weight": "5"
-    # Matches the Job's policy deliberately. The Job carries no hook-succeeded:
-    # it outlives the run so the degraded path leaves a readable record, and
-    # ttlSecondsAfterFinished reclaims it. Reaping the ServiceAccount, Role or
-    # RoleBinding on hook-succeeded or hook-failed would leave that Job able to
-    # start a pod whose ServiceAccount no longer exists: kubelet then mounts the
-    # projected volume without a token, kubectl finds no in-cluster config and
-    # falls back to localhost:8080, and the pre-delete hook fails every uninstall
-    # from then on.
-    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
 rules:
   - apiGroups: ["kafka.strimzi.io"]
     resources: ["kafkatopics"]
@@ -154,15 +138,7 @@ metadata:
   annotations:
     "helm.sh/hook": pre-delete
     "helm.sh/hook-weight": "5"
-    # Matches the Job's policy deliberately. The Job carries no hook-succeeded:
-    # it outlives the run so the degraded path leaves a readable record, and
-    # ttlSecondsAfterFinished reclaims it. Reaping the ServiceAccount, Role or
-    # RoleBinding on hook-succeeded or hook-failed would leave that Job able to
-    # start a pod whose ServiceAccount no longer exists: kubelet then mounts the
-    # projected volume without a token, kubectl finds no in-cluster config and
-    # falls back to localhost:8080, and the pre-delete hook fails every uninstall
-    # from then on.
-    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
 
@@ -82,23 +82,17 @@ tests:
       - isKind:
           of: ServiceAccount
         documentIndex: 1
-      # The Job carries no hook-succeeded, so it outlives the hook run. Every
-      # credential it needs has to outlive it too. A ServiceAccount reaped on
-      # hook-succeeded or hook-failed leaves the Job able to start a pod whose
-      # ServiceAccount is gone: the projected volume mounts without a token,
-      # kubectl falls back to localhost:8080, and the uninstall wedges on a hook
-      # that can no longer reach the apiserver. That is #4276, and it reached
-      # main because nothing here compared the two policies.
+      # The RBAC resources are cleaned up after the hook succeeds.
       - equal:
           path: metadata.annotations["helm.sh/hook-delete-policy"]
-          value: before-hook-creation
+          value: before-hook-creation,hook-succeeded
         documentIndex: 1
       - isKind:
           of: Role
         documentIndex: 2
       - equal:
           path: metadata.annotations["helm.sh/hook-delete-policy"]
-          value: before-hook-creation
+          value: before-hook-creation,hook-succeeded
         documentIndex: 2
       - contains:
           path: rules
@@ -112,7 +106,7 @@ tests:
         documentIndex: 3
       - equal:
           path: metadata.annotations["helm.sh/hook-delete-policy"]
-          value: before-hook-creation
+          value: before-hook-creation,hook-succeeded
         documentIndex: 3
       - equal:
           path: roleRef.name