567d2c671b
Namespace custodian-agents, ServiceAccount custodian-agent (no automount, no token Secret), curated read-only ClusterRole custodian-supervised-observer and its binding, per the founder decision of 2026-10-20. Offline pytest guard asserts no forbidden resource, no write verb, no wildcard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
15 lines
435 B
YAML
15 lines
435 B
YAML
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: custodian-agent-supervised-observer
|
|
labels:
|
|
app.kubernetes.io/part-of: railiance-gitops
|
|
railiance-platform/component: custodian-agent-identity
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: custodian-supervised-observer
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: custodian-agent
|
|
namespace: custodian-agents
|