6b0402ff8b
Odoo's and Nextcloud's Ingress objects live in the default namespace (historical, from the original Docker->k8s migration) rather than their own app namespace like n8n/mautic/erpnext. management-platform-sa had no binding there at all. Granting the full backup ClusterRole in default would be way too broad (default also hosts unrelated live services, and that role includes secrets/pod writes) - so this adds a separate ClusterRole scoped to just ingresses get/list/watch, bound only in default. Needed for the Application Sites page fix (next commit) to read real domain/TLS state instead of guessing. Applied and verified live: can read ingresses in default, still denied secrets/pod-delete there. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017avLHFqkiti3g62Anq9sVA
33 lines
1.3 KiB
YAML
33 lines
1.3 KiB
YAML
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: management-platform-ingress-reader-role
|
|
labels: {owner: ameni-boukattaya, app.kubernetes.io/managed-by: navitrends-pfe-migration}
|
|
rules:
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources: ["ingresses"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
# Odoo's and Nextcloud's Ingress objects live in the `default` namespace
|
|
# (historical — created there during the original Docker->k8s migration,
|
|
# unlike n8n/mautic/erpnext whose Ingress lives in their own app namespace).
|
|
# management-platform-sa has no binding at all in `default` otherwise, and
|
|
# `default` also hosts unrelated live services (cloudops-ingress, jenkins-
|
|
# ingress, stage-navitrends-ingress, etc.) — so this grants ONLY ingress
|
|
# read there, not the full backup ClusterRole, to keep blast radius to
|
|
# exactly what the Application Sites page needs (real domain/TLS lookup).
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: management-platform-ingress-reader-binding
|
|
namespace: default
|
|
labels: {owner: ameni-boukattaya, app.kubernetes.io/managed-by: navitrends-pfe-migration}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: management-platform-ingress-reader-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: management-platform-sa
|
|
namespace: management-platform
|