T4: k8s namespace + capability Roles #20

Merged

ginjiruu merged 3 commits from t4-k8s-capability-roles into master

2026-08-11 18:41:39 +00:00

ginjiruu commented

2026-08-11 17:56:53 +00:00

Owner

By ⁨⁩⁨ginjiruu⁩⁨⁩ — ⁨⁨⁩Open⁨⁩⁩ — ⁨⁩+⁨149⁩ ⁨⁩-⁨3⁩⁨⁩
⁨From ⁨t4-k8s-capability-roles⁩ into ⁨master⁩⁩

Closes #7

Implements T4: the k8s tenant module now creates, per catalog app, a namespace plus namespace-scoped capability Roles per the ADR-0007 k8s column, each bound to the app's kanidm capability group:

viewer / contributor: get/list on non-secret resources (pods, services, configmaps, deployments, statefulsets, ingresses, events, pods/log)
developer: edit (get/list/watch/create/update/patch) on the same non-secret set — no delete
maintainer: developer + delete/deletecollection
live-debugging: get pods + create on pods/exec, pods/attach, pods/portforward
k8s-secret-viewer: get/list secrets (namespace-wide, all-or-nothing per ADR-0007)
root: namespace Role * incl secrets (per app, matching the kanidm <app>-root group)

Each Role has a namespace-scoped RoleBinding whose subject is the matching kanidm group name (group-<app>-<capability>, <app>-root) with kind: Group — membership grants arrive via the OIDC groups claim, never cluster-wide. generated-secret-manager / manual-secret-manager are Vault-only per the matrix and get no Role or binding.

Verification: tofu validate passes; tofu plan is green (30 to add: 2 namespaces + 14 Roles + 14 RoleBindings across privatebin/syncthing).

Wiring note: subject names are the kanidm group names, so the apiserver OIDC setup must request kanidm's groups_name scope and set --oidc-groups-claim=groups for the bindings to match. <app>-root is nested in every capability group (ADR-0007), so root members also match the capability bindings.

By ⁨⁩⁨ginjiruu⁩⁨⁩ — ⁨⁨⁩Open⁨⁩⁩ — ⁨⁩+⁨149⁩ ⁨⁩-⁨3⁩⁨⁩ ⁨From `⁨t4-k8s-capability-roles⁩` into `⁨master⁩`⁩ Closes #7 Implements T4: the k8s tenant module now creates, per catalog app, a namespace plus namespace-scoped capability Roles per the ADR-0007 k8s column, each bound to the app's kanidm capability group: - `viewer` / `contributor`: get/list on non-secret resources (pods, services, configmaps, deployments, statefulsets, ingresses, events, pods/log) - `developer`: edit (get/list/watch/create/update/patch) on the same non-secret set — no delete - `maintainer`: developer + `delete`/`deletecollection` - `live-debugging`: get pods + create on pods/exec, pods/attach, pods/portforward - `k8s-secret-viewer`: get/list secrets (namespace-wide, all-or-nothing per ADR-0007) - `root`: namespace Role `*` incl secrets (per app, matching the kanidm `<app>-root` group) Each Role has a namespace-scoped RoleBinding whose subject is the matching kanidm group name (`group-<app>-<capability>`, `<app>-root`) with `kind: Group` — membership grants arrive via the OIDC groups claim, never cluster-wide. `generated-secret-manager` / `manual-secret-manager` are Vault-only per the matrix and get no Role or binding. Verification: `tofu validate` passes; `tofu plan` is green (30 to add: 2 namespaces + 14 Roles + 14 RoleBindings across privatebin/syncthing). Wiring note: subject names are the kanidm group *names*, so the apiserver OIDC setup must request kanidm's `groups_name` scope and set `--oidc-groups-claim=groups` for the bindings to match. `<app>-root` is nested in every capability group (ADR-0007), so root members also match the capability bindings.

ginjiruu added 1 commit

2026-08-11 17:56:53 +00:00

T4: k8s tenant module: namespace + ADR-0007 capability Roles 5041e5af1f

ginjiruu added 1 commit

2026-08-11 18:30:14 +00:00

T4: bind capability Roles to kanidm groups via RoleBindings 5a4adb6406

ginjiruu added 1 commit

2026-08-11 18:38:41 +00:00

T4: align RoleBinding subjects with hyphenated kanidm group names d55532b025

ginjiruu merged commit 189647866b into master

2026-08-11 18:41:39 +00:00

ginjiruu referenced this pull request from a commit