# Tailscale sidecar RBAC (ServiceAccount + Role + RoleBinding) for the fxhnt-dashboard and dagster
# Deployments. Moved out of infra/k8s/services/fxhnt-dashboard.yaml and infra/k8s/orchestration/dagster.yaml
# (CI review M1): those app manifests are applied every deploy by the fxhnt-ci-deployer ServiceAccount via
# the kubectl-deploy Argo template, and having RBAC objects bundled in there meant the deployer SA needed
# create/update/patch on roles/rolebindings in its own namespace — a privilege-escalation primitive on a
# webhook-triggered SA. This file is STATIC and applied ONCE, out-of-band, by a human:
#
#   kubectl apply -f infra/k8s/rbac/tailscale-sidecars.yaml
#
# It is NOT applied by the CI pipeline. The Deployments still reference these ServiceAccounts via
# `serviceAccountName: tailscale-dashboard` / `tailscale-dagster` — that reference resolves because the
# SAs are managed here, separately, not because the app manifests create them anymore.
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tailscale-dashboard
  namespace: foxhunt
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: tailscale-dashboard
  namespace: foxhunt
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["create", "get", "update", "patch", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tailscale-dashboard
  namespace: foxhunt
subjects:
  - kind: ServiceAccount
    name: tailscale-dashboard
    namespace: foxhunt
roleRef:
  kind: Role
  name: tailscale-dashboard
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: ServiceAccount
metadata: { name: tailscale-dagster, namespace: foxhunt }
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: { name: tailscale-dagster, namespace: foxhunt }
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["create", "get", "update", "patch", "list", "watch"]
  # K8sRunLauncher: the daemon launches each Dagster run as its OWN K8s Job (own memory) so the heavy
  # bybit_book_precompute asset (6-8Gi) never OOMs the 4Gi daemon. Needs to manage Jobs + read their pods/logs.
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["create", "get", "list", "watch", "delete"]
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: { name: tailscale-dagster, namespace: foxhunt }
subjects:
  - { kind: ServiceAccount, name: tailscale-dagster, namespace: foxhunt }
roleRef: { kind: Role, name: tailscale-dagster, apiGroup: rbac.authorization.k8s.io }
