Robert RappandClaude Fable 5.1
31f6435c2f
ci / test (push) Failing after 22s
Vorbereitung für Agenten im Cluster (nex-Spec 2026-10-19, D259/D263/D265): Services ohne Selector auf die Host-Ports von appsrv08, ServiceAccount mit Role nur für den Namespace nex, Pull-Secret aus einer Datei auf ops. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
58 lines
1.6 KiB
YAML
58 lines
1.6 KiB
YAML
# Zugang von nex-admin (läuft auf appsrv08) zum Namespace nex: Agenten als Deployment/PVC/Secret/Service anlegen,
|
||
# exec, Logs, Skalieren (nex-Spec 2026-10-19 Cluster-Agenten, D265). Kein cluster-admin, nur dieser Namespace.
|
||
# Token: Secret nex-admin-token (Typ service-account-token, dauerhaft); playbooks/nex-k3s.yml legt es als Datei auf
|
||
# ops ab (/root/.config/knaster/nex-admin-k8s.token) – von dort in die Stack-Variable NEX_ADMIN_K8S_TOKEN.
|
||
apiVersion: v1
|
||
kind: ServiceAccount
|
||
metadata:
|
||
name: nex-admin
|
||
namespace: nex
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: Role
|
||
metadata:
|
||
name: nex-admin
|
||
namespace: nex
|
||
rules:
|
||
- apiGroups: [""]
|
||
resources: [pods, pods/log]
|
||
verbs: [get, list, watch, create, delete]
|
||
- apiGroups: [""]
|
||
resources: [pods/exec]
|
||
verbs: [create, get]
|
||
- apiGroups: [""]
|
||
resources: [services, persistentvolumeclaims, secrets]
|
||
verbs: [get, list, create, update, patch, delete]
|
||
- apiGroups: [""]
|
||
resources: [endpoints, events]
|
||
verbs: [get, list]
|
||
- apiGroups: [apps]
|
||
resources: [deployments, deployments/scale]
|
||
verbs: [get, list, watch, create, update, patch, delete]
|
||
- apiGroups: [metrics.k8s.io]
|
||
resources: [pods]
|
||
verbs: [get, list]
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: RoleBinding
|
||
metadata:
|
||
name: nex-admin
|
||
namespace: nex
|
||
roleRef:
|
||
apiGroup: rbac.authorization.k8s.io
|
||
kind: Role
|
||
name: nex-admin
|
||
subjects:
|
||
- kind: ServiceAccount
|
||
name: nex-admin
|
||
namespace: nex
|
||
---
|
||
apiVersion: v1
|
||
kind: Secret
|
||
metadata:
|
||
name: nex-admin-token
|
||
namespace: nex
|
||
annotations:
|
||
kubernetes.io/service-account.name: nex-admin
|
||
type: kubernetes.io/service-account-token
|