rock
8bd40c5152
Phase 1: sandbox namespace with PSA restricted enforcement, ResourceQuota (20 pods, 10/20 CPU, 20/40Gi memory), and CiliumNetworkPolicy denying pi-session egress to kube-apiserver. Phase 2: sandbox-observer Role + poimen-devs RoleBinding for OIDC-authenticated kubectl access to sandbox pod status/logs.
24 lines
1.0 KiB
YAML
24 lines
1.0 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# NO top-level `namespace:` transformer - each Role/RoleBinding here targets
|
|
# a different service namespace (logging/storage/cicd/dashboard/sqs/temporal/
|
|
# llm-serving); a transformer would collapse them all into one, same bug
|
|
# already fixed once in k8s/infra/minio and k8s/infra/iam. Every resource
|
|
# here sets its own explicit metadata.namespace.
|
|
resources:
|
|
- admin-oidc-binding.yaml
|
|
- grafana-operator-role.yaml
|
|
- minio-operator-role.yaml
|
|
- forgejo-operator-role.yaml
|
|
- homarr-operator-role.yaml
|
|
- portainer-operator-role.yaml
|
|
- kmsvc-operator-role.yaml
|
|
- temporal-operator-role.yaml
|
|
- llm-serving-operator-role.yaml
|
|
- poimen-memory-operator-role.yaml
|
|
- sandbox-observer-role.yaml
|
|
# paperless's Role/RoleBinding lives in k8s/apps/paperless/rbac.yaml instead -
|
|
# that app already has its own kustomization + namespace, no need to
|
|
# duplicate it here. All of these stay inert (grant nothing) until
|
|
# kube-apiserver has --oidc-groups-claim=groups wired up.
|