nilsandClaude Opus 5.5
461f9d5578
Read-only by default, optional deploy role; no Secrets, exec, port-forward or RBAC. Tokens from kubectl create token, time-limited. Not applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
60 lines
1.9 KiB
YAML
60 lines
1.9 KiB
YAML
# OPTIONAL, on top of role-read.yaml: lets the agent apply this repository's manifests and
|
|
# restart workloads in mg4. Not in kustomization.yaml; add it there only if you want that.
|
|
#
|
|
# Still absent: Secrets, pods/exec, pods/attach, pods/portforward, RBAC, the Namespace itself,
|
|
# and deleting PersistentVolumeClaims (InfluxDB's data lives on one).
|
|
#
|
|
# Note what this does allow: whoever may change a Deployment may run any image in the namespace,
|
|
# and such a pod could mount mg4's Secrets and print them to its log. Read-only is the boundary
|
|
# that holds against a misbehaving agent; this role is for convenience, given trust.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: mg4-agent-deploy
|
|
namespace: mg4
|
|
labels:
|
|
app.kubernetes.io/part-of: mg4
|
|
app.kubernetes.io/component: agent-access
|
|
rules:
|
|
- apiGroups: [apps]
|
|
resources: [deployments, statefulsets]
|
|
verbs: [create, update, patch, delete]
|
|
- apiGroups: [apps]
|
|
resources: [deployments/scale, statefulsets/scale]
|
|
verbs: [get, update, patch]
|
|
- apiGroups: [""]
|
|
resources: [services, configmaps]
|
|
verbs: [create, update, patch, delete]
|
|
- apiGroups: [""]
|
|
resources: [persistentvolumeclaims]
|
|
verbs: [create, update, patch]
|
|
- apiGroups: [""]
|
|
resources: [pods]
|
|
verbs: [delete]
|
|
- apiGroups: [batch]
|
|
resources: [jobs]
|
|
verbs: [create, delete]
|
|
- apiGroups: [networking.k8s.io]
|
|
resources: [networkpolicies]
|
|
verbs: [create, update, patch, delete]
|
|
- apiGroups: [traefik.io]
|
|
resources: [ingressroutes]
|
|
verbs: [create, update, patch, delete]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: mg4-agent-deploy
|
|
namespace: mg4
|
|
labels:
|
|
app.kubernetes.io/part-of: mg4
|
|
app.kubernetes.io/component: agent-access
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: mg4-agent-deploy
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: mg4-agent
|
|
namespace: mg4
|