viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(novelapp): also bind gheorghe's dashboard SA to novelapp admin

Browse source 
His app lives in novelapp, but the dashboard injects his SA token
(system:serviceaccount:vabbit81:dashboard-vabbit81), while the existing
binding only granted the OIDC User vabbit81@gmail.com (OIDC blocked). Add the
SA as a second subject so the web dashboard (token-injector) can manage
novelapp. Verified: SA can list/create in novelapp; injector path returns 200.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-06-04 14:38:16 +00:00
parent 8f13fdeaf7
commit adec2c135f
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
stacks/novelapp/main.tf
View file

@ -245,7 +245,11 @@ module "ingress" {
} }
} }
# RBAC — grant vabbit81 (Gheorghe) admin access to novelapp namespace # RBAC — grant vabbit81 (Gheorghe) admin access to novelapp namespace.
# Two subjects: the OIDC User (for kubectl/kubelogin, once apiserver OIDC works)
# AND his dashboard ServiceAccount (the web dashboard injects this SA's token —
# see stacks/k8s-dashboard/dashboard_injector.tf — so it needs the grant too,
# since the apiserver sees the SA, not the email, as the subject).
resource "kubernetes_role_binding" "novelapp_owner_vabbit81" { resource "kubernetes_role_binding" "novelapp_owner_vabbit81" {
metadata { metadata {
name = "novelapp-owner-vabbit81" name = "novelapp-owner-vabbit81"
@ -261,6 +265,12 @@ resource "kubernetes_role_binding" "novelapp_owner_vabbit81" {
kind = "User" kind = "User"
name = "vabbit81@gmail.com" name = "vabbit81@gmail.com"
} }
subject {
api_group = ""
kind = "ServiceAccount"
name = "dashboard-vabbit81"
namespace = "vabbit81"
}
} }
# Sealed Secrets — encrypted secrets safe to commit to git # Sealed Secrets — encrypted secrets safe to commit to git