Record step 2 of mgmt cluster plan; widen inspector read-only RBAC

Inspector role can now read operator Provider CRs, k3s HelmCharts and nodes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-09-27 10:28:30 +02:00
parent 605d6ebf0d
commit 0592608850
3 changed files with 36 additions and 2 deletions
@@ -6,7 +6,7 @@ Pairs with [docs/plans/2026-09-27-0058-mgmt-cluster-ansible.md](../plans/2026-09

 - [x] Step 0 — Initial import commit + plan commit
 - [x] Step 1 — Scaffold `ansible/`, `.gitignore` exception, syntax/lint checks
- [ ] Step 2 — Run the playbook tag by tag against the lab (owner)
+- [x] Step 2 — Run the playbook tag by tag against the lab (owner)
 - [ ] Step 3 — Idempotency check (second full run `changed=0`)
 - [ ] Step 4 — Docs, versions, decisions, changelog

@@ -86,3 +86,27 @@ idempotent on re-run; `qm status 201` confirmed no half-created VM was left behi
 recoverable DEPRECATED warning: PVE's generated user-data sets `user:` as a string (deprecated
 since cloud-init 22.2). rc 2 = "done with recoverable errors", so the task now fails only on rc
 other than 0/2.
+
+### `--tags k3s`, `addons`, `capi`, `kubeconfig` (owner, all succeeded by 2026-09-27 10:28 CEST)
+
+No further playbook changes needed. Checked afterwards through the read-only kubeconfig
+(`.claude/cluster-inspector/kubeconfigs/lab-mgmt.kubeconfig`):
+
+```bash
+kubectl get pods -A -o wide
+# 14 pods: cert-manager (3), cluster-api-operator, capi / kubeadm bootstrap / kubeadm control
+# plane / capmox / ipam in-cluster controllers — all 1/1 Running, 0 restarts;
+# helm-install-cert-manager and helm-install-cluster-api-operator jobs Completed.
+kubectl -n capmox-system logs deploy/capmox-controller-manager --tail=200 | grep -iE 'error|fail|401|403'
+# (nothing) — but CAPMOX only talks to Proxmox once a ProxmoxCluster exists, so the token is
+# first really exercised in phase-1 Step 3.
+```
+
+The same session hit `Forbidden` on provider CRs, `helmcharts` and `nodes`: the inspector
+role had no `operator.cluster.x-k8s.io` / `helm.cattle.io` access, and built-in `view` has no
+nodes (needed for the agent's own providerID check). Added both API groups plus
+`nodes`/`namespaces` read to `capi-readonly` in `.claude/cluster-inspector/rbac.yaml`; the next
+full playbook run re-applies it via the `inspector` task (`--apply-rbac`).
+
+**Worth noting:** the `.claude/settings.json` allowlist picked up four one-off entries approved
+during this check (`export KUBECONFIG=…`, three exact `kubectl … logs` commands).