kacerrandClaude Opus 5.5
0592608850
Inspector role can now read operator Provider CRs, k3s HelmCharts and nodes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
50 lines
1.8 KiB
YAML
50 lines
1.8 KiB
YAML
# Read-only identity for the cluster-inspector agent.
|
|
# Apply to the management cluster and to every workload cluster the agent should inspect
|
|
# (CAPI rules are simply unused on workload clusters).
|
|
# Built-in `view` excludes Secrets; capi-readonly adds read access to CAPI CRDs and pod logs.
|
|
# Tokens are short-lived TokenRequest tokens minted by make-kubeconfig.sh — no Secret-based token.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: readonly-inspector
|
|
namespace: kube-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: capi-readonly
|
|
rules:
|
|
- apiGroups:
|
|
- cluster.x-k8s.io
|
|
- infrastructure.cluster.x-k8s.io
|
|
- controlplane.cluster.x-k8s.io
|
|
- bootstrap.cluster.x-k8s.io
|
|
- ipam.cluster.x-k8s.io
|
|
- addons.cluster.x-k8s.io
|
|
- clusterctl.cluster.x-k8s.io
|
|
- operator.cluster.x-k8s.io # cluster-api-operator Provider CRs
|
|
- helm.cattle.io # k3s HelmChart CRs
|
|
resources: ["*"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["pods/log"]
|
|
verbs: ["get", "list"]
|
|
# built-in `view` has no cluster-scoped core resources; nodes are needed for providerID checks
|
|
- apiGroups: [""]
|
|
resources: ["nodes", "namespaces"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: readonly-inspector-view
|
|
roleRef: { apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: view }
|
|
subjects: [{ kind: ServiceAccount, name: readonly-inspector, namespace: kube-system }]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: readonly-inspector-capi
|
|
roleRef: { apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: capi-readonly }
|
|
subjects: [{ kind: ServiceAccount, name: readonly-inspector, namespace: kube-system }]
|