# RBAC for CI pipeline — deploy step + self-apply Argo templates
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ci-deploy
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
rules:
  # apps: roll/scale + apply Deployments. watch is required by `kubectl rollout status`; deployments/scale +
  # update by the dashboard scale-0->1 that avoids the tailscale session race (reference_fxhnt_dashboard_proxy).
  - apiGroups: ["apps"]
    resources: [deployments, deployments/scale]
    verbs: [get, list, watch, patch, update]
  - apiGroups: ["argoproj.io"]
    resources: [workflowtemplates, eventsources, sensors, eventbus]
    verbs: [get, list, create, update, patch]
  # core: services/configmaps, plus serviceaccounts (tailscale-dashboard, dagster) and the forward-track PVC
  # — added so the fxhnt-cockpit deploy can `kubectl apply` its full manifest set without a partial-apply failure.
  - apiGroups: [""]
    resources: [services, configmaps, serviceaccounts, persistentvolumeclaims]
    verbs: [get, list, create, update, patch]
  # pods: read-only, for `kubectl wait --for=delete pod` during the dashboard scale-0->1
  - apiGroups: [""]
    resources: [pods]
    verbs: [get, list, watch]
  - apiGroups: ["networking.k8s.io"]
    resources: [networkpolicies]
    verbs: [get, list, create, update, patch]
  # batch: the fxhnt CronJobs (bybit/ibkr rebalancers, compare-measured-precompute)
  - apiGroups: ["batch"]
    resources: [cronjobs]
    verbs: [get, list, create, update, patch]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: [roles, rolebindings]
    verbs: [get, list, create, update, patch, bind, escalate]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ci-deploy
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ci-deploy
subjects:
  - kind: ServiceAccount
    name: argo-workflow
    namespace: foxhunt
