apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: management-platform-backup-role
  labels:
    owner: ameni-boukattaya
    app.kubernetes.io/managed-by: navitrends-pfe-migration
rules:
  # Read + resolve exec targets (deploy/<name> shorthand needs get on the
  # Deployment plus get/list on the Pods it selects).
  - apiGroups: [""]
    resources: ["pods", "persistentvolumeclaims"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch"]
  # Read-only manifest capture for backup (`kubectl get deployment,service,
  # configmap,ingress -o yaml`). Services and Deployments are already
  # readable via management-platform-viewer-role (this SA also holds that
  # binding — see management-platform-viewer-rbac.yaml); configmaps and
  # ingresses are not, so they're granted explicitly here. Read-only, no
  # write — matches "no write beyond scale" for everything but Secrets.
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]
  # Run pg_dump/mysqldump/psql/mysql/tar inside existing DB and app pods,
  # and inside the short-lived loader pod restore creates for PVC repopulation.
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create"]
  # Create/delete ONLY the short-lived alpine loader pod restore uses to
  # repopulate a PVC after the app Deployment is scaled to 0 (no running
  # app pod exists at that point to exec into — see restore-k8s-apps.sh
  # step 3). Does not grant any write on the app/DB Deployments' own pods.
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["create", "delete"]
  # Scale only — deliberately NOT "update"/"patch" on the deployments
  # resource itself, so this role cannot change a Deployment's image,
  # env, mounts, etc. Same-cluster restore never reconciles Deployment/
  # Service/ConfigMap/Ingress specs; those are captured in each backup's
  # manifests.yaml for reference but are not re-applied by restore-k8s-apps.sh.
  - apiGroups: ["apps"]
    resources: ["deployments/scale"]
    verbs: ["get", "update", "patch"]
  # Read DB credentials for pg_dump/mysqldump/psql/mysql (backup + restore),
  # and roll a Secret's values back to what's in the backup during restore
  # (kubectl apply -f secret.yaml). No create/delete — every Secret this
  # role touches already exists; restore only ever updates in place.
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "update", "patch"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: management-platform-sa
  namespace: management-platform
  labels:
    owner: ameni-boukattaya
    app.kubernetes.io/managed-by: navitrends-pfe-migration
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: management-platform-backup-binding
  namespace: n8n
  labels:
    owner: ameni-boukattaya
    app.kubernetes.io/managed-by: navitrends-pfe-migration
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: management-platform-backup-role
subjects:
  - kind: ServiceAccount
    name: management-platform-sa
    namespace: management-platform
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: management-platform-backup-binding
  namespace: odoo
  labels:
    owner: ameni-boukattaya
    app.kubernetes.io/managed-by: navitrends-pfe-migration
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: management-platform-backup-role
subjects:
  - kind: ServiceAccount
    name: management-platform-sa
    namespace: management-platform
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: management-platform-backup-binding
  namespace: mautic
  labels:
    owner: ameni-boukattaya
    app.kubernetes.io/managed-by: navitrends-pfe-migration
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: management-platform-backup-role
subjects:
  - kind: ServiceAccount
    name: management-platform-sa
    namespace: management-platform
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: management-platform-backup-binding
  namespace: nextcloud
  labels:
    owner: ameni-boukattaya
    app.kubernetes.io/managed-by: navitrends-pfe-migration
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: management-platform-backup-role
subjects:
  - kind: ServiceAccount
    name: management-platform-sa
    namespace: management-platform
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: management-platform-backup-binding
  namespace: erpnext
  labels:
    owner: ameni-boukattaya
    app.kubernetes.io/managed-by: navitrends-pfe-migration
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: management-platform-backup-role
subjects:
  - kind: ServiceAccount
    name: management-platform-sa
    namespace: management-platform