# k8s/rbac-traefik.yaml
# ============================================
# Grant Gitea runner SA permission to manage
# Traefik Middleware CRDs in the app namespace.
#
# Apply once per cluster/namespace:
#   kubectl apply -f k8s/rbac-traefik.yaml
#
# Variables (envsubst):
#   NAMESPACE       - app namespace (e.g. gobha-ai-chat)
#   RUNNER_SA_NS    - runner SA namespace (default: gitea-runner)
# ============================================
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: traefik-middleware-manager
  namespace: ${NAMESPACE}
  labels:
    app: switchboard
rules:
  - apiGroups: ["traefik.io"]
    resources: ["middlewares"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: gitea-runner-traefik-middleware
  namespace: ${NAMESPACE}
  labels:
    app: switchboard
subjects:
  - kind: ServiceAccount
    name: gitea-runner-sa
    namespace: ${RUNNER_SA_NS:-gitea-runner}
roleRef:
  kind: Role
  name: traefik-middleware-manager
  apiGroup: rbac.authorization.k8s.io