# Read-only view of the mg4 namespace: what runs, its logs and events, its configuration.
# Deliberately absent: Secrets (any verb), pods/exec, pods/attach, pods/portforward, RBAC.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: mg4-agent-read
  namespace: mg4
  labels:
    app.kubernetes.io/part-of: mg4
    app.kubernetes.io/component: agent-access
rules:
  - apiGroups: [""]
    resources: [pods, pods/log, services, endpoints, configmaps, persistentvolumeclaims, events, serviceaccounts]
    verbs: [get, list, watch]
  - apiGroups: [apps]
    resources: [deployments, statefulsets, replicasets]
    verbs: [get, list, watch]
  - apiGroups: [batch]
    resources: [jobs, cronjobs]
    verbs: [get, list, watch]
  - apiGroups: [networking.k8s.io]
    resources: [networkpolicies]
    verbs: [get, list, watch]
  - apiGroups: [events.k8s.io]
    resources: [events]
    verbs: [get, list, watch]
  - apiGroups: [traefik.io]
    resources: [ingressroutes, middlewares]
    verbs: [get, list, watch]
  - apiGroups: [metrics.k8s.io]
    resources: [pods]
    verbs: [get, list]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: mg4-agent-read
  namespace: mg4
  labels:
    app.kubernetes.io/part-of: mg4
    app.kubernetes.io/component: agent-access
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: mg4-agent-read
subjects:
  - kind: ServiceAccount
    name: mg4-agent
    namespace: mg4