T4: k8s namespace + capability Roles #7

New issue

Closed

opened 2026-08-11 15:20:37 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-08-11 15:20:37 +00:00

Owner

Parent

Spec: catalog-driven app bootstrapping and capability groups (#2)

What to build

Each catalog app gets its namespace plus a namespace-scoped k8s Role per capability group per ADR-0007 — so a developer's group membership maps to the right k8s RBAC without any cluster-wide power.

Acceptance criteria

k8s tenant module creates namespace per app
Role per capability: viewer get/list non-secret; contributor read; developer edit non-secret; maintainer edit+write; live-debugging get pods + create on pods/exec, pods/attach, pods/portforward; k8s-secret-viewer get/list secrets; root Role * incl secrets
all Roles namespace-scoped (no ClusterRole; storage classes/gateways/ingress classes stay cluster-operator resources)
tofu validate + tofu plan pass

Blocked by

T1: Fix provider resolution + catalog schema (prefactor) (#3)

## Parent Spec: catalog-driven app bootstrapping and capability groups (#2) ## What to build Each catalog app gets its namespace plus a namespace-scoped k8s Role per capability group per ADR-0007 — so a developer's group membership maps to the right k8s RBAC without any cluster-wide power. ## Acceptance criteria - [ ] k8s tenant module creates namespace per app - [ ] Role per capability: viewer get/list non-secret; contributor read; developer edit non-secret; maintainer edit+write; live-debugging get pods + create on pods/exec, pods/attach, pods/portforward; k8s-secret-viewer get/list secrets; root Role `*` incl secrets - [ ] all Roles namespace-scoped (no ClusterRole; storage classes/gateways/ingress classes stay cluster-operator resources) - [ ] `tofu validate` + `tofu plan` pass ## Blocked by - T1: Fix provider resolution + catalog schema (prefactor) (#3)

ginjiruu referenced this issue

2026-08-11 15:20:44 +00:00

T7: Root wiring + pilot apps (integration) #9

ginjiruu added the

ready-for-agent

label

2026-08-11 15:20:57 +00:00

ginjiruu referenced this issue from a pull request that will close it,

2026-08-11 17:56:53 +00:00

T4: k8s namespace + capability Roles #20

ginjiruu referenced this issue

2026-08-11 18:38:15 +00:00