# OPTIONAL, on top of role-read.yaml: lets the agent apply this repository's manifests and
# restart workloads in mg4. Not in kustomization.yaml; add it there only if you want that.
#
# Still absent: Secrets, pods/exec, pods/attach, pods/portforward, RBAC, the Namespace itself,
# and deleting PersistentVolumeClaims (InfluxDB's data lives on one).
#
# Note what this does allow: whoever may change a Deployment may run any image in the namespace,
# and such a pod could mount mg4's Secrets and print them to its log. Read-only is the boundary
# that holds against a misbehaving agent; this role is for convenience, given trust.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: mg4-agent-deploy
  namespace: mg4
  labels:
    app.kubernetes.io/part-of: mg4
    app.kubernetes.io/component: agent-access
rules:
  - apiGroups: [apps]
    resources: [deployments, statefulsets]
    verbs: [create, update, patch, delete]
  - apiGroups: [apps]
    resources: [deployments/scale, statefulsets/scale]
    verbs: [get, update, patch]
  - apiGroups: [""]
    resources: [services, configmaps]
    verbs: [create, update, patch, delete]
  - apiGroups: [""]
    resources: [persistentvolumeclaims]
    verbs: [create, update, patch]
  - apiGroups: [""]
    resources: [pods]
    verbs: [delete]
  - apiGroups: [batch]
    resources: [jobs]
    verbs: [create, delete]
  - apiGroups: [networking.k8s.io]
    resources: [networkpolicies]
    verbs: [create, update, patch, delete]
  - apiGroups: [traefik.io]
    resources: [ingressroutes]
    verbs: [create, update, patch, delete]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: mg4-agent-deploy
  namespace: mg4
  labels:
    app.kubernetes.io/part-of: mg4
    app.kubernetes.io/component: agent-access
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: mg4-agent-deploy
subjects:
  - kind: ServiceAccount
    name: mg4-agent
    namespace: mg4