kacerrandClaude Opus 5.5
5fd998c5f9
Phase 1-3 runbooks and design notes, version pins, config templates, project-history conventions, cluster-inspector read-only credentials setup. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
44 lines
1.5 KiB
YAML
44 lines
1.5 KiB
YAML
# Read-only identity for the cluster-inspector agent.
|
|
# Apply to the management cluster and to every workload cluster the agent should inspect
|
|
# (CAPI rules are simply unused on workload clusters).
|
|
# Built-in `view` excludes Secrets; capi-readonly adds read access to CAPI CRDs and pod logs.
|
|
# Tokens are short-lived TokenRequest tokens minted by make-kubeconfig.sh — no Secret-based token.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: readonly-inspector
|
|
namespace: kube-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: capi-readonly
|
|
rules:
|
|
- apiGroups:
|
|
- cluster.x-k8s.io
|
|
- infrastructure.cluster.x-k8s.io
|
|
- controlplane.cluster.x-k8s.io
|
|
- bootstrap.cluster.x-k8s.io
|
|
- ipam.cluster.x-k8s.io
|
|
- addons.cluster.x-k8s.io
|
|
- clusterctl.cluster.x-k8s.io
|
|
resources: ["*"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["pods/log"]
|
|
verbs: ["get", "list"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: readonly-inspector-view
|
|
roleRef: { apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: view }
|
|
subjects: [{ kind: ServiceAccount, name: readonly-inspector, namespace: kube-system }]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: readonly-inspector-capi
|
|
roleRef: { apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: capi-readonly }
|
|
subjects: [{ kind: ServiceAccount, name: readonly-inspector, namespace: kube-system }]
|