4e60f69f93
Founder decision 2026-11-06, option A, 1 h tokens. ServiceAccount sso/nk-agent-status without automount; read-only Jobs, pods, Deployments and ExternalSecrets in sso; one named ConfigMap in informed-decision; the informed-decision Application in argocd. No Secrets, pod logs, exec, writes or cluster scope. Guard: tests/test_nk_agent_status_rbac.py. The Application follows in the next commit, pinned here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
12 lines
583 B
YAML
12 lines
583 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
# net-kingdom NK-WP-0058-T05, founder decision 4af1ec01 (option A, 2026-11-06). Read only by
|
|
# argocd/railiance01/applications/nk-agent-status.application.yaml.
|
|
# Read-only status identity for the net-kingdom agent on the bounded-execution path (SI-14: the agent presents as
|
|
# itself). No Secret, no static token, no write verb, no pod logs. Credentials are 1 h TokenRequest tokens that the
|
|
# founder mints per working session (net-kingdom `make agent-status-token`).
|
|
|
|
resources:
|
|
- serviceaccount.yaml
|
|
- rbac.yaml
|