apiVersion: v1
kind: ServiceAccount
metadata:
  name: api-gateway
  namespace: api
  labels:
    app: api-gateway
---
# Role for ServiceAdapter CRD access (read-only, G2 supersession)
# Scoped to exactly: get, list, watch on serviceadapters in gateway.riotpiao.com/v1
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: api-gateway-serviceadapter-reader
  namespace: api
  labels:
    app: api-gateway
rules:
- apiGroups:
  - gateway.riotpiao.com
  resources:
  - serviceadapters
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: api-gateway-serviceadapter-reader
  namespace: api
  labels:
    app: api-gateway
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: api-gateway-serviceadapter-reader
subjects:
- kind: ServiceAccount
  name: api-gateway
  namespace: api
---
# No ClusterRole needed - the gateway has no k8s API access
# G2: The gateway holds no Kubernetes credentials (except read-only ServiceAdapter access above)