567d2c671b
Namespace custodian-agents, ServiceAccount custodian-agent (no automount, no token Secret), curated read-only ClusterRole custodian-supervised-observer and its binding, per the founder decision of 2026-10-20. Offline pytest guard asserts no forbidden resource, no write verb, no wildcard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
14 lines
534 B
YAML
14 lines
534 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
# RPF-WP-0062 / CUST-WP-0073-T02. Read only by
|
|
# argocd/railiance01/applications/custodian-agents.application.yaml.
|
|
# Read-only observer identity for supervised custodian agents. No Secret, no
|
|
# static token, no write verb. Credentials are short-lived TokenRequest tokens
|
|
# issued by the supervisor (see workplans/RPF-WP-0062-custodian-agent-observer-identity.md).
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- serviceaccount.yaml
|
|
- clusterrole.yaml
|
|
- clusterrolebinding.yaml
|