161 lines
4.1 KiB
YAML
161 lines
4.1 KiB
YAML
{{- if .Values.rbac.create -}}
|
|
# Read-only ClusterRole for kubectl-mcp-server.
|
|
#
|
|
# * get/list/watch ONLY — no create/update/patch/delete anywhere. This is
|
|
# the enforcement layer behind the server's own deny-by-default allowlist
|
|
# (the server never registers any write/destructive tool).
|
|
# * `secrets` is EXCLUDED from core resources — the RCA bot has no business
|
|
# reading Secret payloads, and the server omits get_secrets entirely.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ include "kubectl-mcp-server.name" . }}
|
|
labels:
|
|
{{- include "kubectl-mcp-server.labels" . | nindent 4 }}
|
|
rules:
|
|
# Core API resources - read access (secrets intentionally omitted)
|
|
- apiGroups: [""]
|
|
resources:
|
|
- pods
|
|
- pods/log
|
|
- pods/status
|
|
- services
|
|
- endpoints
|
|
- persistentvolumeclaims
|
|
- persistentvolumes
|
|
- configmaps
|
|
- serviceaccounts
|
|
- namespaces
|
|
- nodes
|
|
- nodes/status
|
|
- events
|
|
- resourcequotas
|
|
- limitranges
|
|
- replicationcontrollers
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Apps API resources
|
|
- apiGroups: ["apps"]
|
|
resources:
|
|
- deployments
|
|
- daemonsets
|
|
- replicasets
|
|
- statefulsets
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Batch API resources
|
|
- apiGroups: ["batch"]
|
|
resources:
|
|
- jobs
|
|
- cronjobs
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Networking API resources
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources:
|
|
- ingresses
|
|
- networkpolicies
|
|
- ingressclasses
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Storage API resources
|
|
- apiGroups: ["storage.k8s.io"]
|
|
resources:
|
|
- storageclasses
|
|
- volumeattachments
|
|
- csidrivers
|
|
- csinodes
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# RBAC API resources
|
|
- apiGroups: ["rbac.authorization.k8s.io"]
|
|
resources:
|
|
- roles
|
|
- rolebindings
|
|
- clusterroles
|
|
- clusterrolebindings
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Autoscaling API resources
|
|
- apiGroups: ["autoscaling"]
|
|
resources:
|
|
- horizontalpodautoscalers
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Policy API resources
|
|
- apiGroups: ["policy"]
|
|
resources:
|
|
- poddisruptionbudgets
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# API extensions
|
|
- apiGroups: ["apiextensions.k8s.io"]
|
|
resources:
|
|
- customresourcedefinitions
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Admissionregistration API
|
|
- apiGroups: ["admissionregistration.k8s.io"]
|
|
resources:
|
|
- mutatingwebhookconfigurations
|
|
- validatingwebhookconfigurations
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Certificates API
|
|
- apiGroups: ["certificates.k8s.io"]
|
|
resources:
|
|
- certificatesigningrequests
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Coordination API
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources:
|
|
- leases
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Metrics API for resource usage (kubectl top)
|
|
- apiGroups: ["metrics.k8s.io"]
|
|
resources:
|
|
- nodes
|
|
- pods
|
|
verbs: ["get", "list"]
|
|
|
|
# Discovery API
|
|
- apiGroups: ["discovery.k8s.io"]
|
|
resources:
|
|
- endpointslices
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# KEDA + Argo Rollouts CRs (read-only) — common at Meesho, used by the
|
|
# server's keda_* / rollouts_* inspection tools
|
|
- apiGroups: ["keda.sh"]
|
|
resources:
|
|
- scaledobjects
|
|
- scaledjobs
|
|
- triggerauthentications
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["argoproj.io"]
|
|
resources:
|
|
- rollouts
|
|
- analysisruns
|
|
- analysistemplates
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Contour CRs (read-only) — Meesho ingress is Contour HTTPProxy almost
|
|
# everywhere; needed to answer "what's the route/hostname for service X"
|
|
- apiGroups: ["projectcontour.io"]
|
|
resources:
|
|
- httpproxies
|
|
- tlscertificatedelegations
|
|
- extensionservices
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Flagger canaries (read-only) — canary.enabled is standard in the 2.0.0
|
|
# chart; lets the server explain canary rollout state
|
|
- apiGroups: ["flagger.app"]
|
|
resources:
|
|
- canaries
|
|
- metrictemplates
|
|
verbs: ["get", "list", "watch"]
|
|
{{- end }}
|