2026-08-25 15:03:44 -07:00
|
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
|
|
|
kind: Kustomization
|
|
|
|
|
# NO top-level `namespace:` transformer - each Role/RoleBinding here targets
|
|
|
|
|
# a different service namespace (logging/storage/cicd/dashboard/sqs/temporal/
|
|
|
|
|
# llm-serving); a transformer would collapse them all into one, same bug
|
|
|
|
|
# already fixed once in k8s/infra/minio and k8s/infra/iam. Every resource
|
|
|
|
|
# here sets its own explicit metadata.namespace.
|
|
|
|
|
resources:
|
|
|
|
|
- grafana-operator-role.yaml
|
|
|
|
|
- minio-operator-role.yaml
|
|
|
|
|
- forgejo-operator-role.yaml
|
|
|
|
|
- homarr-operator-role.yaml
|
|
|
|
|
- portainer-operator-role.yaml
|
|
|
|
|
- kmsvc-operator-role.yaml
|
|
|
|
|
- temporal-operator-role.yaml
|
|
|
|
|
- llm-serving-operator-role.yaml
|
2026-08-25 21:50:05 -07:00
|
|
|
- poimen-memory-operator-role.yaml
|
2026-08-25 15:03:44 -07:00
|
|
|
# paperless's Role/RoleBinding lives in k8s/apps/paperless/rbac.yaml instead -
|
|
|
|
|
# that app already has its own kustomization + namespace, no need to
|
|
|
|
|
# duplicate it here. All of these stay inert (grant nothing) until
|
|
|
|
|
# kube-apiserver has --oidc-groups-claim=groups wired up.
|
