# Bounded executor identity in sso (NK-WP-0056-T03). PREPARED IN SOURCE, NOT APPLIED.
#
# The ServiceAccount the executor runs as, with exactly the pilot's Kubernetes authority (T06: rotate the
# svc-authelia bind): force-sync one ExternalSecret and restart one Deployment. No Secret, ConfigMap or Pod
# access, no create/delete, no wildcard, no cluster scope. Its OpenBao and LLDAP credentials are declared in
# tools/service-identity/declarations/bounded-executor.yaml; all of it acts only under a consumed admission
# (canon/standards/bounded-execution-admission_v0.1.md). Packaging and apply belong to rapp-bounded-executor
# (ADR-0015, founder decision 6d1adce9). Tests: sso-mfa/k8s/bounded-executor/test_rbac.py.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: nk-bind-executor
  namespace: sso
  labels:
    app.kubernetes.io/name: bounded-executor
    app.kubernetes.io/part-of: net-kingdom-sso-mfa
automountServiceAccountToken: false   # the executor pod mounts a projected, audience-bound token instead
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: nk-bind-executor
  namespace: sso
  labels:
    app.kubernetes.io/name: bounded-executor
rules:
  # restart: kubectl rollout restart patches the pod template annotation; rollout status reads and watches
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["authelia"]
    verbs: ["get", "watch", "patch"]
  # deliver: force-sync annotation, then read status (Ready, refreshTime) as the check; never the Secret
  - apiGroups: ["external-secrets.io"]
    resources: ["externalsecrets"]
    resourceNames: ["authelia-secrets"]
    verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: nk-bind-executor
  namespace: sso
  labels:
    app.kubernetes.io/name: bounded-executor
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: nk-bind-executor
subjects:
  - kind: ServiceAccount
    name: nk-bind-executor
    namespace: sso