567d2c671b
Namespace custodian-agents, ServiceAccount custodian-agent (no automount, no token Secret), curated read-only ClusterRole custodian-supervised-observer and its binding, per the founder decision of 2026-10-20. Offline pytest guard asserts no forbidden resource, no write verb, no wildcard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
53 lines
1.6 KiB
YAML
53 lines
1.6 KiB
YAML
# Curated read-only observer (founder decision 2026-10-20, CUST-WP-0073-T02).
|
|
# Verbs: get/list/watch only. Explicitly excluded: secrets, configmaps,
|
|
# pods/log, pods/exec, pods/attach, pods/portforward, serviceaccounts/token,
|
|
# nodes/proxy, any write verb, any wildcard. Privileged actions go through the
|
|
# separate gated executor; nothing here grants writes.
|
|
# Enforced offline by tests/test_custodian_agent_rbac.py.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: custodian-supervised-observer
|
|
labels:
|
|
app.kubernetes.io/part-of: railiance-gitops
|
|
railiance-platform/component: custodian-agent-identity
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources:
|
|
- namespaces
|
|
- nodes
|
|
- pods
|
|
- services
|
|
- endpoints
|
|
- events
|
|
- persistentvolumeclaims
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["apps"]
|
|
resources:
|
|
- deployments
|
|
- statefulsets
|
|
- daemonsets
|
|
- replicasets
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["discovery.k8s.io"]
|
|
resources: ["endpointslices"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources: ["ingresses"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["events.k8s.io"]
|
|
resources: ["events"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["argoproj.io"]
|
|
resources:
|
|
- applications
|
|
- appprojects
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["postgresql.cnpg.io"]
|
|
resources:
|
|
- clusters
|
|
- backups
|
|
- scheduledbackups
|
|
verbs: ["get", "list", "watch"]
|
|
- nonResourceURLs: ["/version", "/healthz", "/livez", "/readyz"]
|
|
verbs: ["get"]
|