Skip to content

Conversation

@jeremyeder
Copy link
Collaborator

Summary

Migrates ClusterRole and ClusterRoleBinding resources to namespace-scoped Role and RoleBinding to enable deployment within specific namespaces rather than requiring cluster-wide permissions.

Changes Made

Backend RBAC

  • backend-clusterrole.yaml: Changed from ClusterRole to Role
  • backend-clusterrolebinding.yaml: Changed from ClusterRoleBinding to RoleBinding, removed namespace from subjects

Operator RBAC

  • operator-clusterrole.yaml: Changed from ClusterRole to Role, removed namespace permissions
  • operator-clusterrolebinding.yaml: Changed from ClusterRoleBinding to RoleBinding, removed namespace from subjects

Test Plan

  • Deploy manifests to a test namespace
  • Verify backend and operator pods start successfully with namespace-scoped permissions
  • Test that custom resource operations work within the target namespace
  • Confirm no cluster-wide access is required

Breaking Changes

⚠️ Important: The operator role previously had cluster-wide namespace access which has been removed. If the operator needs to detect/manage other namespaces, additional permissions will need to be granted separately.

🤖 Generated with Claude Code

jeremyeder and others added 5 commits September 24, 2025 18:08
- Fix YAML format to use messages array instead of custom fields
- Use openai/gpt-4o-mini model as per documentation
- Simplify content to single line to avoid parsing issues
- Include required testData and evaluators arrays

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
- Remove multiline formatting that may cause YAML parsing issues
- Use simple single-line content field
- Match exact documentation example format

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
- Change from 1-space to 2-space indentation to match exact documentation format
- Use >+ multiline format exactly as shown in working example

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
- Use absolute minimal YAML format to isolate parsing issue
- Remove all multiline content that could cause issues
- Test with simplest possible valid format

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
…nd RoleBinding

- Convert backend ClusterRole to Role for namespace-scoped permissions
- Convert backend ClusterRoleBinding to RoleBinding, remove namespace from subjects
- Convert operator ClusterRole to Role, remove cluster-wide namespace permissions
- Convert operator ClusterRoleBinding to RoleBinding, remove namespace from subjects

This allows the RBAC resources to be deployed within a specific namespace
rather than requiring cluster-wide permissions.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
@jeremyeder jeremyeder closed this Sep 25, 2025
@jeremyeder jeremyeder deleted the feature/rbac-only-namespace-migration branch September 25, 2025 18:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant