apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: management-platform-ingress-reader-role
  labels: {owner: ameni-boukattaya, app.kubernetes.io/managed-by: navitrends-pfe-migration}
rules:
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]
---
# Odoo's and Nextcloud's Ingress objects live in the `default` namespace
# (historical — created there during the original Docker->k8s migration,
# unlike n8n/mautic/erpnext whose Ingress lives in their own app namespace).
# management-platform-sa has no binding at all in `default` otherwise, and
# `default` also hosts unrelated live services (cloudops-ingress, jenkins-
# ingress, stage-navitrends-ingress, etc.) — so this grants ONLY ingress
# read there, not the full backup ClusterRole, to keep blast radius to
# exactly what the Application Sites page needs (real domain/TLS lookup).
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: management-platform-ingress-reader-binding
  namespace: default
  labels: {owner: ameni-boukattaya, app.kubernetes.io/managed-by: navitrends-pfe-migration}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: management-platform-ingress-reader-role
subjects:
  - kind: ServiceAccount
    name: management-platform-sa
    namespace: management-platform