f3f08c3ef6
The pod running app.py had no kubectl binary and only a read-only SA (management-platform-viewer-sa) — backup-k8s-apps.sh/restore-k8s-apps.sh could never actually run from inside it. Adds: - management-platform-backup-role (ClusterRole, bound via RoleBinding only in n8n/odoo/mautic/nextcloud/erpnext — not cluster-wide): get/list/watch on pods/deployments/configmaps/ingresses/PVCs, pods/exec create, pods create+delete (needed for restore's populate-before-scale-up loader pod), secrets get/list/update/patch, deployments/scale update/patch only (no write on full Deployment/Service/ConfigMap/Ingress specs). - management-platform-sa, replacing management-platform-viewer-sa as the pod's identity — inherits the old viewer-role's read-only bindings too (retargeted in management-platform-viewer-rbac.yaml) so the existing cluster-view page keeps working under one SA. - k3s binary hostPath-mounted read-only into the pod (same pattern as the Jenkins agent's docker-cli container), so `k3s kubectl` is available where no separate kubectl binary exists. Both scripts updated to fall back to k3s kubectl when no kubectl is on PATH, and to use /proc/meminfo instead of `free` for the resource-safety check (not present in the pod's minimal image). Also fixes a real issue found while live-testing this from inside the pod: the pod's pre-existing /root hostPath mount also exposes the host's own admin ~/.kube/config, which k3s kubectl was silently preferring over the scoped SA token — forcing --kubeconfig=/dev/null in both scripts closes that. Verified end-to-end from inside the actual management-platform pod: manifests/secret/DB-dump/PVC-data backup for n8n succeeds under the new SA's scoped permissions, and a kube-system access attempt is correctly rejected (Forbidden) once the kubeconfig leak is closed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
151 lines
3.9 KiB
YAML
151 lines
3.9 KiB
YAML
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: management-platform-viewer-role
|
|
labels:
|
|
owner: ameni-boukattaya
|
|
app.kubernetes.io/managed-by: navitrends-pfe-migration
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods", "services"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: management-platform-viewer-binding
|
|
namespace: n8n
|
|
labels:
|
|
owner: ameni-boukattaya
|
|
app.kubernetes.io/managed-by: navitrends-pfe-migration
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: management-platform-viewer-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: management-platform-sa
|
|
namespace: management-platform
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: management-platform-viewer-binding
|
|
namespace: odoo
|
|
labels:
|
|
owner: ameni-boukattaya
|
|
app.kubernetes.io/managed-by: navitrends-pfe-migration
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: management-platform-viewer-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: management-platform-sa
|
|
namespace: management-platform
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: management-platform-viewer-binding
|
|
namespace: mautic
|
|
labels:
|
|
owner: ameni-boukattaya
|
|
app.kubernetes.io/managed-by: navitrends-pfe-migration
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: management-platform-viewer-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: management-platform-sa
|
|
namespace: management-platform
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: management-platform-viewer-binding
|
|
namespace: erpnext
|
|
labels:
|
|
owner: ameni-boukattaya
|
|
app.kubernetes.io/managed-by: navitrends-pfe-migration
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: management-platform-viewer-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: management-platform-sa
|
|
namespace: management-platform
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: management-platform-viewer-binding
|
|
namespace: nextcloud
|
|
labels:
|
|
owner: ameni-boukattaya
|
|
app.kubernetes.io/managed-by: navitrends-pfe-migration
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: management-platform-viewer-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: management-platform-sa
|
|
namespace: management-platform
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: management-platform-viewer-binding
|
|
namespace: jenkins-agents
|
|
labels:
|
|
owner: ameni-boukattaya
|
|
app.kubernetes.io/managed-by: navitrends-pfe-migration
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: management-platform-viewer-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: management-platform-sa
|
|
namespace: management-platform
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: management-platform-viewer-binding
|
|
namespace: jenkins
|
|
labels:
|
|
owner: ameni-boukattaya
|
|
app.kubernetes.io/managed-by: navitrends-pfe-migration
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: management-platform-viewer-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: management-platform-sa
|
|
namespace: management-platform
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: management-platform-viewer-binding
|
|
namespace: management-platform
|
|
labels:
|
|
owner: ameni-boukattaya
|
|
app.kubernetes.io/managed-by: navitrends-pfe-migration
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: management-platform-viewer-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: management-platform-sa
|
|
namespace: management-platform
|