Namespace nex: Brücke zu appsrv08, Zugang für nex-admin, Pull-Secret

Vorbereitung für Agenten im Cluster (nex-Spec 2026-10-19, D259/D263/D265): Services ohne Selector auf die Host-Ports von appsrv08, ServiceAccount mit Role nur für den Namespace nex, Pull-Secret aus einer Datei auf ops. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-19 13:45:18 +02:00
parent 02adb2f4b2
commit 31f6435c2f
5 changed files with 232 additions and 0 deletions
@@ -0,0 +1,57 @@
+# Zugang von nex-admin (läuft auf appsrv08) zum Namespace nex: Agenten als Deployment/PVC/Secret/Service anlegen,
+# exec, Logs, Skalieren (nex-Spec 2026-10-19 Cluster-Agenten, D265). Kein cluster-admin, nur dieser Namespace.
+# Token: Secret nex-admin-token (Typ service-account-token, dauerhaft); playbooks/nex-k3s.yml legt es als Datei auf
+# ops ab (/root/.config/knaster/nex-admin-k8s.token) – von dort in die Stack-Variable NEX_ADMIN_K8S_TOKEN.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nex-admin
+  namespace: nex
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: nex-admin
+  namespace: nex
+rules:
+  - apiGroups: [""]
+    resources: [pods, pods/log]
+    verbs: [get, list, watch, create, delete]
+  - apiGroups: [""]
+    resources: [pods/exec]
+    verbs: [create, get]
+  - apiGroups: [""]
+    resources: [services, persistentvolumeclaims, secrets]
+    verbs: [get, list, create, update, patch, delete]
+  - apiGroups: [""]
+    resources: [endpoints, events]
+    verbs: [get, list]
+  - apiGroups: [apps]
+    resources: [deployments, deployments/scale]
+    verbs: [get, list, watch, create, update, patch, delete]
+  - apiGroups: [metrics.k8s.io]
+    resources: [pods]
+    verbs: [get, list]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: nex-admin
+  namespace: nex
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: nex-admin
+subjects:
+  - kind: ServiceAccount
+    name: nex-admin
+    namespace: nex
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nex-admin-token
+  namespace: nex
+  annotations:
+    kubernetes.io/service-account.name: nex-admin
+type: kubernetes.io/service-account-token