Record step 2 of mgmt cluster plan; widen inspector read-only RBAC

Inspector role can now read operator Provider CRs, k3s HelmCharts and nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/cluster-inspector/rbac.yaml

@@ -22,11 +22,17 @@ rules:
       - ipam.cluster.x-k8s.io
       - addons.cluster.x-k8s.io
       - clusterctl.cluster.x-k8s.io
+      - operator.cluster.x-k8s.io   # cluster-api-operator Provider CRs
+      - helm.cattle.io              # k3s HelmChart CRs
     resources: ["*"]
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["pods/log"]
     verbs: ["get", "list"]
+  # built-in `view` has no cluster-scoped core resources; nodes are needed for providerID checks
+  - apiGroups: [""]
+    resources: ["nodes", "namespaces"]
+    verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

.claude/settings.json

@@ -8,7 +8,11 @@
       "Bash(git add:*)",
       "Bash(date:*)",
       "Bash(tea pr create:*)",
-      "Read(//private/tmp/**)"
+      "Read(//private/tmp/**)",
+      "Bash(export KUBECONFIG=.claude/cluster-inspector/kubeconfigs/lab-mgmt.kubeconfig)",
+      "Bash(kubectl -n capmox-system logs deploy/capmox-controller-manager --tail=200)",
+      "Bash(kubectl -n capmox-system logs deploy/capmox-controller-manager --tail=5)",
+      "Bash(kubectl -n capi-operator-system logs deploy/cluster-api-operator --tail=300)"
     ]
   }
 }

docs/plans-executions/2026-09-27-0058-mgmt-cluster-ansible.md

@@ -6,7 +6,7 @@ Pairs with [docs/plans/2026-09-27-0058-mgmt-cluster-ansible.md](../plans/2026-09
 
 - [x] Step 0 — Initial import commit + plan commit
 - [x] Step 1 — Scaffold `ansible/`, `.gitignore` exception, syntax/lint checks
-- [ ] Step 2 — Run the playbook tag by tag against the lab (owner)
+- [x] Step 2 — Run the playbook tag by tag against the lab (owner)
 - [ ] Step 3 — Idempotency check (second full run `changed=0`)
 - [ ] Step 4 — Docs, versions, decisions, changelog
 
@@ -86,3 +86,27 @@ idempotent on re-run; `qm status 201` confirmed no half-created VM was left behi
 recoverable DEPRECATED warning: PVE's generated user-data sets `user:` as a string (deprecated
 since cloud-init 22.2). rc 2 = "done with recoverable errors", so the task now fails only on rc
 other than 0/2.
+
+### `--tags k3s`, `addons`, `capi`, `kubeconfig` (owner, all succeeded by 2026-09-27 10:28 CEST)
+
+No further playbook changes needed. Checked afterwards through the read-only kubeconfig
+(`.claude/cluster-inspector/kubeconfigs/lab-mgmt.kubeconfig`):
+
+```bash
+kubectl get pods -A -o wide
+# 14 pods: cert-manager (3), cluster-api-operator, capi / kubeadm bootstrap / kubeadm control
+# plane / capmox / ipam in-cluster controllers — all 1/1 Running, 0 restarts;
+# helm-install-cert-manager and helm-install-cluster-api-operator jobs Completed.
+kubectl -n capmox-system logs deploy/capmox-controller-manager --tail=200 | grep -iE 'error|fail|401|403'
+# (nothing) — but CAPMOX only talks to Proxmox once a ProxmoxCluster exists, so the token is
+# first really exercised in phase-1 Step 3.
+```
+
+The same session hit `Forbidden` on provider CRs, `helmcharts` and `nodes`: the inspector
+role had no `operator.cluster.x-k8s.io` / `helm.cattle.io` access, and built-in `view` has no
+nodes (needed for the agent's own providerID check). Added both API groups plus
+`nodes`/`namespaces` read to `capi-readonly` in `.claude/cluster-inspector/rbac.yaml`; the next
+full playbook run re-applies it via the `inspector` task (`--apply-rbac`).
+
+**Worth noting:** the `.claude/settings.json` allowlist picked up four one-off entries approved
+during this check (`export KUBECONFIG=…`, three exact `kubectl … logs` commands).