Story Crater Bot
6c758e3606
Follows the portainer/kmsvc/temporal pattern - group + "permissions" claim entry only, no Authentik Application/OAuth provider, since poimen-memory is an internal API-key service, not browser OIDC login. rock gets it automatically (already in every service_admin_group).
22 lines
986 B
YAML
22 lines
986 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# NO top-level `namespace:` transformer - each Role/RoleBinding here targets
|
|
# a different service namespace (logging/storage/cicd/dashboard/sqs/temporal/
|
|
# llm-serving); a transformer would collapse them all into one, same bug
|
|
# already fixed once in k8s/infra/minio and k8s/infra/iam. Every resource
|
|
# here sets its own explicit metadata.namespace.
|
|
resources:
|
|
- grafana-operator-role.yaml
|
|
- minio-operator-role.yaml
|
|
- forgejo-operator-role.yaml
|
|
- homarr-operator-role.yaml
|
|
- portainer-operator-role.yaml
|
|
- kmsvc-operator-role.yaml
|
|
- temporal-operator-role.yaml
|
|
- llm-serving-operator-role.yaml
|
|
- poimen-memory-operator-role.yaml
|
|
# paperless's Role/RoleBinding lives in k8s/apps/paperless/rbac.yaml instead -
|
|
# that app already has its own kustomization + namespace, no need to
|
|
# duplicate it here. All of these stay inert (grant nothing) until
|
|
# kube-apiserver has --oidc-groups-claim=groups wired up.
|