ClusterRole: read pods/services/configmaps across cluster Tekton access: create/list/watch pipelineruns, taskruns Namespace RoleBindings: poimen, tekton-pipelines, llm-serving, kube-system Fixes: Forbidden errors when CI tries to list services
