# Read-only identity for the cluster-inspector agent.
# Apply to the management cluster and to every workload cluster the agent should inspect
# (CAPI rules are simply unused on workload clusters).
# Built-in `view` excludes Secrets; capi-readonly adds read access to CAPI CRDs and pod logs.
# Tokens are short-lived TokenRequest tokens minted by make-kubeconfig.sh — no Secret-based token.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: readonly-inspector
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: capi-readonly
rules:
  - apiGroups:
      - cluster.x-k8s.io
      - infrastructure.cluster.x-k8s.io
      - controlplane.cluster.x-k8s.io
      - bootstrap.cluster.x-k8s.io
      - ipam.cluster.x-k8s.io
      - addons.cluster.x-k8s.io
      - clusterctl.cluster.x-k8s.io
      - operator.cluster.x-k8s.io   # cluster-api-operator Provider CRs
      - helm.cattle.io              # k3s HelmChart CRs
    resources: ["*"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get", "list"]
  # built-in `view` has no cluster-scoped core resources; nodes are needed for providerID checks
  - apiGroups: [""]
    resources: ["nodes", "namespaces"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: readonly-inspector-view
roleRef: { apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: view }
subjects: [{ kind: ServiceAccount, name: readonly-inspector, namespace: kube-system }]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: readonly-inspector-capi
roleRef: { apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: capi-readonly }
subjects: [{ kind: ServiceAccount, name: readonly-inspector, namespace: kube-system }]