Changeset 0.28.8 (#194)

k8s/rbac-traefik.yaml

@@ -0,0 +1,39 @@
+# k8s/rbac-traefik.yaml
+# ============================================
+# Grant Gitea runner SA permission to manage
+# Traefik Middleware CRDs in the app namespace.
+#
+# Apply once per cluster/namespace:
+#   kubectl apply -f k8s/rbac-traefik.yaml
+#
+# Variables (envsubst):
+#   NAMESPACE       - app namespace (e.g. gobha-ai-chat)
+#   RUNNER_SA_NS    - runner SA namespace (default: gitea-runner)
+# ============================================
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: traefik-middleware-manager
+  namespace: ${NAMESPACE}
+  labels:
+    app: switchboard
+rules:
+  - apiGroups: ["traefik.io"]
+    resources: ["middlewares"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gitea-runner-traefik-middleware
+  namespace: ${NAMESPACE}
+  labels:
+    app: switchboard
+subjects:
+  - kind: ServiceAccount
+    name: gitea-runner-sa
+    namespace: ${RUNNER_SA_NS:-gitea-runner}
+roleRef:
+  kind: Role
+  name: traefik-middleware-manager
+  apiGroup: rbac.authorization.k8s.io