From c58f19ccda769a7d64bea87e6defde7d4651da14 Mon Sep 17 00:00:00 2001
From: root <root@vmi3024229.contaboserver.net>
Date: Fri, 14 Aug 2026 03:17:25 +0200
Subject: [PATCH] Add read-only RBAC for management-platform cluster-view SA

ServiceAccount management-platform-viewer-sa (in management-platform ns),
ClusterRole management-platform-viewer-role (get/list/watch on pods,
services, deployments.apps only - no secrets, no write verbs), and a
RoleBinding per app namespace (n8n, odoo, mautic, erpnext, nextcloud,
jenkins-agents, jenkins, management-platform). Already applied to the
live cluster and verified via kubectl auth can-i; committing here for
source-of-truth tracking.
---
 management-platform-viewer-rbac.yaml | 159 +++++++++++++++++++++++++++
 1 file changed, 159 insertions(+)
 create mode 100644 management-platform-viewer-rbac.yaml

diff --git a/management-platform-viewer-rbac.yaml b/management-platform-viewer-rbac.yaml
new file mode 100644
index 0000000..3647c8b
--- /dev/null
+++ b/management-platform-viewer-rbac.yaml
@@ -0,0 +1,159 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: management-platform-viewer-sa
+  namespace: management-platform
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: management-platform-viewer-role
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "services"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: n8n
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: odoo
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: mautic
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: erpnext
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: nextcloud
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: jenkins-agents
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: jenkins
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-viewer-binding
+  namespace: management-platform
+  labels:
+    owner: ameni-boukattaya
+    app.kubernetes.io/managed-by: navitrends-pfe-migration
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-viewer-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-viewer-sa
+    namespace: management-platform