# RBAC for the fxhnt CI pipeline — all fxhnt-owned, in the foxhunt namespace (project boundary).
#
# Fills the two gaps the first real workflow run surfaced (2026-07-21):
#   1. The fxhnt-cockpit WorkflowTemplate references SA `argo-workflow`, which existed in `argo` (where msp
#      builds) but NOT in `foxhunt` (where fxhnt's project boundary places its build/deploy pods).
#   2. The build-fxhnt Sensor (argo-events-sa) submits Workflows into `foxhunt`; the bizworx `workflow-submitter`
#      Role only granted that in `argo`, so a cross-namespace submit into foxhunt was forbidden.
#
# Least privilege: the workflow SA gets exactly what Argo needs to run pods + what the kubectl-deploy step does
# (apply/scale/annotate/rollout-status the two daemon Deployments and their Services/NetworkPolicies), nothing more.
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: argo-workflow
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: fxhnt-ci }
---
# Argo needs the workflow SA to write task results (the minimum the workflow-controller requires per step).
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: fxhnt-argo-workflow
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: fxhnt-ci }
rules:
  - apiGroups: ["argoproj.io"]
    resources: ["workflowtaskresults"]
    verbs: ["create", "patch"]
---
# The kubectl-deploy step's exact actions on the foxhunt daemons — scoped to what it runs, no wildcards.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: fxhnt-ci-deployer
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: fxhnt-ci }
rules:
  # apply + scale + annotate + rollout-status the daemon Deployments (dashboard, dagster).
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
  - apiGroups: ["apps"]
    resources: ["deployments/scale"]
    verbs: ["get", "update", "patch"]
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]           # rollout status reads the RS
  # apply the Services the manifests contain, and `wait --for=delete pod` + rollout status read pods.
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
  # the fxhnt-dashboard + dagster manifests also bundle ConfigMaps (the tailscale sidecar serve-config) —
  # kubectl apply of the whole file must be able to read/apply them. NOTE (CI review M1): the tailscale
  # ServiceAccount + Role + RoleBinding objects were MOVED out of these app manifests into
  # infra/k8s/rbac/tailscale-sidecars.yaml (applied once, out-of-band, by a human) specifically so this
  # deployer SA does not need roles/rolebindings/serviceaccounts create-update-patch — that combination on a
  # webhook-triggered SA is a privilege-escalation primitive. Neither manifest applied by CI creates a
  # ServiceAccount anymore, so `serviceaccounts` is dropped from this grant too.
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
  # the manifests apply NetworkPolicies (fxhnt-cockpit.yaml + dagster's).
  - apiGroups: ["networking.k8s.io"]
    resources: ["networkpolicies"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: fxhnt-argo-workflow
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: fxhnt-ci }
subjects:
  - { kind: ServiceAccount, name: argo-workflow, namespace: foxhunt }
roleRef:
  kind: Role
  name: fxhnt-argo-workflow
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: fxhnt-ci-deployer
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: fxhnt-ci }
subjects:
  - { kind: ServiceAccount, name: argo-workflow, namespace: foxhunt }
roleRef:
  kind: Role
  name: fxhnt-ci-deployer
  apiGroup: rbac.authorization.k8s.io
---
# Cross-namespace: let the shared argo-events-sa submit Workflows into foxhunt (the sensor lives in argo-events
# but its Workflow runs here). Mirrors the bizworx `workflow-submitter` Role, scoped to foxhunt.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: fxhnt-workflow-submitter
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: fxhnt-ci }
rules:
  - apiGroups: ["argoproj.io"]
    resources: ["workflows"]
    verbs: ["create", "get", "list", "watch"]
  - apiGroups: ["argoproj.io"]
    resources: ["workflowtemplates"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: argo-events-sa-fxhnt-submitter
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: fxhnt-ci }
subjects:
  - { kind: ServiceAccount, name: argo-events-sa, namespace: argo-events }
roleRef:
  kind: Role
  name: fxhnt-workflow-submitter
  apiGroup: rbac.authorization.k8s.io
