# Zugang von nex-admin (läuft auf appsrv08) zum Namespace nex: Agenten als Deployment/PVC/Secret/Service anlegen,
# exec, Logs, Skalieren (nex-Spec 2026-10-19 Cluster-Agenten, D265). Kein cluster-admin, nur dieser Namespace.
# Token: Secret nex-admin-token (Typ service-account-token, dauerhaft); playbooks/nex-k3s.yml legt es als Datei auf
# ops ab (/root/.config/knaster/nex-admin-k8s.token) – von dort in die Stack-Variable NEX_ADMIN_K8S_TOKEN.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: nex-admin
  namespace: nex
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: nex-admin
  namespace: nex
rules:
  - apiGroups: [""]
    resources: [pods, pods/log]
    verbs: [get, list, watch, create, delete]
  - apiGroups: [""]
    resources: [pods/exec]
    verbs: [create, get]
  - apiGroups: [""]
    resources: [services, persistentvolumeclaims, secrets]
    verbs: [get, list, create, update, patch, delete]
  - apiGroups: [""]
    resources: [endpoints, events]
    verbs: [get, list]
  - apiGroups: [apps]
    resources: [deployments, deployments/scale]
    verbs: [get, list, watch, create, update, patch, delete]
  - apiGroups: [metrics.k8s.io]
    resources: [pods]
    verbs: [get, list]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: nex-admin
  namespace: nex
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: nex-admin
subjects:
  - kind: ServiceAccount
    name: nex-admin
    namespace: nex
---
apiVersion: v1
kind: Secret
metadata:
  name: nex-admin-token
  namespace: nex
  annotations:
    kubernetes.io/service-account.name: nex-admin
type: kubernetes.io/service-account-token