rock 8bd40c5152 feat: poimen-sandbox namespace + security hardening + RBAC ...

Phase 1: sandbox namespace with PSA restricted enforcement,
ResourceQuota (20 pods, 10/20 CPU, 20/40Gi memory), and
CiliumNetworkPolicy denying pi-session egress to kube-apiserver.

Phase 2: sandbox-observer Role + poimen-devs RoleBinding for
OIDC-authenticated kubectl access to sandbox pod status/logs.

2026-09-28 23:15:25 +08:00

..

admin-oidc-binding.yaml

fix: remove spec wrapper from ClusterRoleBinding

2026-09-05 15:04:00 -07:00

forgejo-operator-role.yaml

feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring

2026-08-25 15:03:44 -07:00

grafana-operator-role.yaml

feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring

2026-08-25 15:03:44 -07:00

homarr-operator-role.yaml

feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring

2026-08-25 15:03:44 -07:00

kmsvc-operator-role.yaml

feat: add ServiceAccounts for poimen-memory/kmsvc/immich operator Roles

2026-08-26 19:51:05 -07:00

kustomization.yaml

feat: poimen-sandbox namespace + security hardening + RBAC

2026-09-28 23:15:25 +08:00

llm-serving-operator-role.yaml

feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring

2026-08-25 15:03:44 -07:00

minio-operator-role.yaml

feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring

2026-08-25 15:03:44 -07:00

poimen-memory-operator-role.yaml

feat: add ServiceAccounts for poimen-memory/kmsvc/immich operator Roles

2026-08-26 19:51:05 -07:00

portainer-operator-role.yaml

feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring

2026-08-25 15:03:44 -07:00

sandbox-observer-role.yaml

feat: poimen-sandbox namespace + security hardening + RBAC

2026-09-28 23:15:25 +08:00

temporal-operator-role.yaml

feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring

2026-08-25 15:03:44 -07:00