# RBAC for the Gitea Actions deploy pipeline.
#
# ADMIN BOOTSTRAP — applied once by a human with cluster-admin
# (NOT part of the root kustomization: the pipeline's own token must not be
# able to escalate its privileges):
#   kubectl apply -f rbac/gitea-deployer.yaml
#
# Binds to the existing `gitea-deployer` ServiceAccount in `default`
# (token secret: default/gitea-deployer-token — the same identity the
# socktop-webterm pipeline uses).
#
# Deliberately granted: the resource kinds this repo contains, cluster-wide.
# Deliberately NOT granted: secrets (app secrets are created out-of-band),
# RBAC objects, nodes, or delete on anything.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: homelab-k3s-deployer
rules:
  - apiGroups: [""]
    resources:
      - namespaces
      - persistentvolumes
      - persistentvolumeclaims
      - services
    verbs: [get, list, watch, create, update, patch]
  - apiGroups: [apps]
    resources: [deployments]
    verbs: [get, list, watch, create, update, patch]
  - apiGroups: [networking.k8s.io]
    resources: [ingresses]
    verbs: [get, list, watch, create, update, patch]
  - apiGroups: [apps]
    resources: [replicasets]
    verbs: [get, list, watch]
  - apiGroups: [""]
    resources: [pods, events]
    verbs: [get, list, watch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: homelab-k3s-deployer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: homelab-k3s-deployer
subjects:
  - kind: ServiceAccount
    name: gitea-deployer
    namespace: default