60101b0932
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13690-09e0-7cd1-964b-ec83cdbcd348
2.6 KiB
| id | title | status | revision | owner | date | last_reviewed | review_interval |
|---|---|---|---|---|---|---|---|
| RPLAT-ADR-0006 | ADR-0006 — Give Playwright consumers a dedicated namespace-scoped group | accepted | 1.0 | railiance-platform | 2026-10-13 | 2026-10-13 | 6m |
Context
rapp-playwright's published private pilot has a namespace Role but deliberately no consumer binding. The user requested establishing a group during the Platform open-work review. Existing cluster documentation provides administrative access; the live binding inventory contains no non-system consumer group.
Decision
Establish Kubernetes RBAC group subject playwright-consumers, bound only to
the package-owned playwright-consumer Role in namespace playwright. Platform
owns the RoleBinding; rapp-playwright retains the Role and workload source.
The initial membership policy includes all identified platform humans and coding
agents, as explicitly directed by the user. No per-use-case membership restriction
is introduced now. The identity/cluster owners must implement an authenticated
group claim for those entities before general consumer availability is accepted.
Consequences
The Role permits pod get/list, pod port-forward creation and get of Deployment
playwright. It grants no Secrets, pod exec, workload writes, identity
impersonation or other namespaces. The namespace must remain dedicated to this
service because pod discovery and forwarding cover all its pods. Membership
confers browser-job submission for the reviewed trusted targets; it does not
authorize private targets, hostile pages or mutually untrusted tenant workloads.
Kubernetes has no separate Group object to create. This establishes an RBAC subject and permissions, not a KeyCape group, login integration or membership. Administrator impersonation can verify the permission boundary but cannot prove consumer authentication. RPF-WP-0056 retains those outstanding acceptance steps.
Rollback removes only the Platform RoleBinding after reviewing its exact live identity; it does not delete the Namespace, workload or artifact PVC. Existing port-forwards require separate termination when revoking a consumer's active access. Do not treat removal of a binding as proof that a running tunnel closed.
Alternatives considered
Binding all authenticated users would broaden browser access beyond the human/coding-agent identity population. Sharing the administrator kubeconfig would convey unrelated cluster authority. Both are rejected. Selecting OIDC configuration or issuing client certificates without an owner-supported membership route remains outside this bounded group-binding change.