# MCP::K8s Deployer Service Account
#
# Read access to most resources, plus deploy/restart capabilities
# for Deployments, StatefulSets, DaemonSets, and ConfigMaps.
#
# Usage:
#   kubectl apply -f deployer-serviceaccount.yaml
#   MCP_K8S_TOKEN=$(kubectl create token mcp-k8s-deployer -n mcp-k8s) \
#   MCP_K8S_SERVER=https://<your-cluster> mcp-k8s

apiVersion: v1
kind: Namespace
metadata:
  name: mcp-k8s
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: mcp-k8s-deployer
  namespace: mcp-k8s
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: mcp-k8s-deployer
rules:
  # RBAC self-discovery (required for MCP::K8s permission detection)
  - apiGroups: ["authorization.k8s.io"]
    resources: ["selfsubjectrulesreviews"]
    verbs: ["create"]
  # Core resources: read-only
  - apiGroups: [""]
    resources:
      - pods
      - services
      - endpoints
      - events
      - namespaces
      - nodes
      - persistentvolumes
      - persistentvolumeclaims
      - resourcequotas
      - limitranges
      - serviceaccounts
    verbs: ["get", "list", "watch"]
  # Pod logs
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get"]
  # ConfigMaps: read + write (for config updates during deploy)
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
  # Apps resources: read + deploy/restart
  - apiGroups: ["apps"]
    resources:
      - deployments
      - statefulsets
      - daemonsets
    verbs: ["get", "list", "watch", "update", "patch"]
  # ReplicaSets: read-only (for deployment status)
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  # Batch resources: read-only
  - apiGroups: ["batch"]
    resources: ["jobs", "cronjobs"]
    verbs: ["get", "list", "watch"]
  # Networking: read-only
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses", "networkpolicies"]
    verbs: ["get", "list", "watch"]
  # Autoscaling: read + patch (for scaling)
  - apiGroups: ["autoscaling"]
    resources: ["horizontalpodautoscalers"]
    verbs: ["get", "list", "watch", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: mcp-k8s-deployer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: mcp-k8s-deployer
subjects:
  - kind: ServiceAccount
    name: mcp-k8s-deployer
    namespace: mcp-k8s