---
# ── version-tracker: read-only pod/namespace lister (weekly report) ──────────
apiVersion: v1
kind: ServiceAccount
metadata:
  name: version-tracker
  namespace: k8s-version-tracker

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: version-tracker-reader
rules:
  - apiGroups: [""]
    resources: ["pods", "namespaces"]
    verbs: ["get", "list", "watch"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: version-tracker-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: version-tracker-reader
subjects:
  - kind: ServiceAccount
    name: version-tracker
    namespace: k8s-version-tracker

---
# ── upgrade-requester: read-only pod lister (upgrades go through GitOps/ArgoCD) ─
apiVersion: v1
kind: ServiceAccount
metadata:
  name: upgrade-requester
  namespace: k8s-version-tracker

---
# Reuse the same read-only ClusterRole — no direct workload patching needed.
# Image updates are committed to argocd-gitops and ArgoCD syncs automatically.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: upgrade-requester
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: version-tracker-reader
subjects:
  - kind: ServiceAccount
    name: upgrade-requester
    namespace: k8s-version-tracker

---
# ── version-tracker-web: dashboard service account ───────────────────────────
apiVersion: v1
kind: ServiceAccount
metadata:
  name: version-tracker-web
  namespace: k8s-version-tracker

---
# Cluster-wide read access: pods, namespaces, and workload owners (to map pods → apps)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: version-tracker-web-reader
rules:
  - apiGroups: [""]
    resources: ["pods", "namespaces"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["batch"]
    resources: ["jobs", "cronjobs"]
    verbs: ["get", "list", "watch"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: version-tracker-web-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: version-tracker-web-reader
subjects:
  - kind: ServiceAccount
    name: version-tracker-web
    namespace: k8s-version-tracker

---
# Namespace-scoped: create upgrade Jobs in this namespace only
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: upgrade-trigger
  namespace: k8s-version-tracker
rules:
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["create", "get", "list", "watch"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: upgrade-trigger
  namespace: k8s-version-tracker
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: upgrade-trigger
subjects:
  - kind: ServiceAccount
    name: version-tracker-web
    namespace: k8s-version-tracker