60101b0932
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13690-09e0-7cd1-964b-ec83cdbcd348
54 lines
2.6 KiB
Markdown
54 lines
2.6 KiB
Markdown
---
|
|
id: RPLAT-ADR-0006
|
|
title: "ADR-0006 — Give Playwright consumers a dedicated namespace-scoped group"
|
|
status: accepted
|
|
revision: "1.0"
|
|
owner: railiance-platform
|
|
date: "2026-10-13"
|
|
last_reviewed: "2026-10-13"
|
|
review_interval: 6m
|
|
---
|
|
|
|
## Context
|
|
|
|
rapp-playwright's published private pilot has a namespace Role but deliberately
|
|
no consumer binding. The user requested establishing a group during the Platform
|
|
open-work review. Existing cluster documentation provides administrative access;
|
|
the live binding inventory contains no non-system consumer group.
|
|
|
|
## Decision
|
|
|
|
Establish Kubernetes RBAC group subject `playwright-consumers`, bound only to
|
|
the package-owned `playwright-consumer` Role in namespace `playwright`. Platform
|
|
owns the RoleBinding; rapp-playwright retains the Role and workload source.
|
|
The initial membership policy includes all identified platform humans and coding
|
|
agents, as explicitly directed by the user. No per-use-case membership restriction
|
|
is introduced now. The identity/cluster owners must implement an authenticated
|
|
group claim for those entities before general consumer availability is accepted.
|
|
|
|
## Consequences
|
|
|
|
The Role permits pod get/list, pod port-forward creation and get of Deployment
|
|
`playwright`. It grants no Secrets, pod exec, workload writes, identity
|
|
impersonation or other namespaces. The namespace must remain dedicated to this
|
|
service because pod discovery and forwarding cover all its pods. Membership
|
|
confers browser-job submission for the reviewed trusted targets; it does not
|
|
authorize private targets, hostile pages or mutually untrusted tenant workloads.
|
|
|
|
Kubernetes has no separate Group object to create. This establishes an RBAC
|
|
subject and permissions, not a KeyCape group, login integration or membership.
|
|
Administrator impersonation can verify the permission boundary but cannot prove
|
|
consumer authentication. RPF-WP-0056 retains those outstanding acceptance steps.
|
|
|
|
Rollback removes only the Platform RoleBinding after reviewing its exact live
|
|
identity; it does not delete the Namespace, workload or artifact PVC. Existing
|
|
port-forwards require separate termination when revoking a consumer's active
|
|
access. Do not treat removal of a binding as proof that a running tunnel closed.
|
|
|
|
## Alternatives considered
|
|
|
|
Binding all authenticated users would broaden browser access beyond the human/coding-agent
|
|
identity population. Sharing the administrator kubeconfig would convey unrelated cluster
|
|
authority. Both are rejected. Selecting OIDC configuration or issuing client
|
|
certificates without an owner-supported membership route remains outside this
|
|
bounded group-binding change.
|